ConnectWise suffered a cyberattack carried out by a sophisticated nation state actor

ConnectWise ScreenConnect (ConnectWise Control), a widely used remote-access and remote-monitoring tool, contains an authentication bypass (CWE-288) in its management interface. An attacker needs only network access to the management interface to trigger the flaw, with no valid credentials or user interaction required. A successful attacker gains administrative control of the ScreenConnect server by creating a new administrator-level account, providing a foothold that has already been used in ransomware campaigns against downstream managed environments. Any organization running ConnectWise ScreenConnect is affected, especially managed service providers and IT teams whose management interface is reachable from the internet; the source data specifies affected products but no version ranges. Exploitation is confirmed and urgent: CISA added the flaw to the KEV on 2024-02-22 with known ransomware use, EPSS assigns a 100% probability of exploitation within 30 days, and ConnectWise warned that no patch was available at the time of disclosure.

Do: Follow ConnectWise's instructions immediately: no patch existed at disclosure, so apply the vendor's mitigations or, per the CISA KEV required action, restrict internet exposure of the management interface or discontinue use until mitigations are available, then upgrade to the vendor's patched release as soon as it ships. Audit ScreenConnect servers for unexpectedly created administrator-level accounts and unusual remote sessions, which are the attack's artifacts. Prioritize any instance whose management interface is reachable from the internet, given confirmed in-the-wild exploitation and known ransomware use.

ConnectWise ScreenConnect versions 25.2.3 and earlier rely on ASP.NET Web Forms ViewState, whose integrity depends on machine keys; if an attacker with privileged system-level access obtains those keys, they can craft and send a malicious ViewState that the server deserializes, potentially resulting in remote code execution. The risk stems from platform-level ASP.NET behavior rather than a defect introduced by ScreenConnect, and the ScreenConnect Client is not directly impacted, though the CVSS vector (PR:H) confirms exploitation requires already having high privileges on the host. An attacker who achieves this gains code execution on the server with the confidentiality, integrity, and availability impact reflected in the 7.2 High score. ScreenConnect 2025.4 mitigates the issue by disabling ViewState entirely and removing any dependency on it. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-06-02, indicating confirmed exploitation in the wild, with EPSS estimating a 3.4% chance of exploitation in the next 30 days (88th percentile).

Do: Upgrade to ScreenConnect 2025.4, which disables ViewState and removes any dependency on it, per vendor instructions and CISA BOD 22-01 requirements; if an upgrade is not immediately possible, apply vendor mitigations or discontinue use of the affected product. Because exploitation requires compromised machine keys, administrators who suspect prior privileged compromise should also review and rotate ASP.NET machine keys and investigate for signs of system-level access. Note ConnectWise is separately rotating ScreenConnect code signing certificates following a nation-state intrusion, so check vendor advisories for related hardening steps.