ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability

概要

参考情報

• ConnectWise-Advisories/Disclosures · Third Party Advisory
• connectwise.com/company/trust/advisories · Vendor Advisory
• connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletin · Vendor Advisory
• cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
• huntress.com/blog/rogue-screenconnect-installations · Third Party Advisory
• CISA KEV · CVE-2026-84869

screenconnect のその他の脆弱性

• CVE-2026-11596中 4.7In ScreenConnect™ versions prior to 26.2, input validation within the Host Pass creation functionality could allow an authenticated user wit…
• CVE-2025-14823中 5.3In deployments using the ScreenConnect™ Certificate Signing Extension, encrypted configuration values including an Azure Key Vault-related k…
• CVE-2025-14265緊急 9.1In versions of ScreenConnect™ prior to 25.8, server-side validation and integrity checks within the extension subsystem could allow the inst…
• CVE-2025-3935高 7.2悪用確認済み（CISA KEV）ScreenConnect versions 25.2.3 and earlier versions may be susceptible to a ViewState code injection attack. ASP.NET Web Forms use ViewState …
• CVE-2024-1709緊急 10.0悪用確認済み（CISA KEV）ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel vulnerability, whic…