CVE-2025-3935
ConnectWise ScreenConnect Improper Authentication Vulnerability
ConnectWise ScreenConnect
ScreenConnect versions 25.2.3 and earlier versions may be susceptible to a ViewState code injection attack. ASP.NET Web Forms use ViewState to preserve page and control state, with data encoded using Base64 protected by machine keys. It is important to note that to obtain these machine keys, privileged system level access must be obtained. If these machine keys are compromised, attackers could create and send a malicious ViewState to the website, potentially leading to remote code execution on the server. The risk does not originate from a vulnerability introduced by ScreenConnect, but from platform level behavior. This had no direct impact to ScreenConnect Client. ScreenConnect 2025.4 patch disables ViewState and removes any dependency on it.
Exploitation status
CISA Known Exploited Vulnerabilities
Listed by CISA on 2 June 2025. US federal agencies were required to remediate it by 23 June 2025.
EPSS — exploitation probability
FIRST puts the probability of exploitation activity in the next 30 days at 3.6%, which is higher than 89.5% of all scored vulnerabilities. EPSS is a forecast of activity, not a measure of severity, and it is rescored daily.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Frequently asked questions
Is CVE-2025-3935 being exploited by ransomware groups?
No ransomware group in this database is currently recorded as exploiting CVE-2025-3935.
What does CVE-2025-3935 affect?
CVE-2025-3935 affects ConnectWise ScreenConnect. ScreenConnect versions 25.2.3 and earlier versions may be susceptible to a ViewState code injection attack. ASP.NET Web Forms use ViewState to preserve page and control state, with data encoded using Base64 protected by machine keys. It is important to note that to obtain these machine keys, privileged system level access must be obtained. If these machine keys are compromised, attackers could create and send a malicious ViewState to the website, potentially leading to remote code execution on the server. The risk does not originate from a vulnerability introduced by ScreenConnect, but from platform level behavior. This had no direct impact to ScreenConnect Client. ScreenConnect 2025.4 patch disables ViewState and removes any dependency on it.
How severe is CVE-2025-3935?
CVE-2025-3935 is rated HIGH with a CVSS base score of 8.1. EPSS puts the probability of exploitation in the next 30 days at 3.6%, higher than 89.5% of all scored vulnerabilities. It is listed in the CISA Known Exploited Vulnerabilities catalog, with a federal remediation deadline of 23 June 2025.
How should organisations respond to CVE-2025-3935?
Apply the vendor patch for ConnectWise ScreenConnect as the first priority, and treat any internet-facing instance as the most urgent. Because this vulnerability is associated with ransomware activity, also review whether the affected systems were reachable before patching, rather than assuming that patching alone closes the incident.