PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-3935 ConnectWise CVE debrief

CVE-2025-3935 is an improper authentication vulnerability in ConnectWise ScreenConnect that CISA added to the Known Exploited Vulnerabilities catalog on 2025-06-02. Because it is listed in KEV, defenders should treat it as urgent and follow vendor mitigation guidance immediately. CISA’s remediation guidance is to apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Vendor
ConnectWise
Product
ScreenConnect
CVSS
Unknown
CISA KEV
Listed
Original CVE published
2025-06-02
Original CVE updated
2025-06-02
Advisory published
2025-06-02
Advisory updated
2025-06-02

Who should care

Organizations using ConnectWise ScreenConnect, especially MSPs, IT support teams, and any environment that exposes ScreenConnect to users or the internet. Security and vulnerability management teams should prioritize this CVE because it is in CISA KEV.

Technical summary

The available official sources identify CVE-2025-3935 as an improper authentication issue affecting ConnectWise ScreenConnect. The supplied corpus does not include exploit mechanics, affected version ranges, or proof-of-concept details. What is clear from the CISA KEV listing is that the vulnerability is known to be exploited in the wild and requires prompt remediation.

Defensive priority

Highest priority. CISA KEV inclusion means the issue is actively relevant to defenders and should be addressed on an urgent timeline, with remediation completed by the KEV due date if possible.

Recommended defensive actions

  • Apply the vendor’s mitigation or patch guidance for ScreenConnect immediately.
  • If ScreenConnect is hosted in a cloud or managed service context, follow applicable BOD 22-01 guidance.
  • If mitigations are unavailable, discontinue use of the product until a secure remediation path exists.
  • Verify all ScreenConnect instances, including internet-facing deployments, and confirm they are covered by your remediation plan.
  • Track completion against CISA’s KEV due date of 2025-06-23.
  • Review authentication and access logs for unusual activity around ScreenConnect administration and remote support use.

Evidence notes

This debrief is grounded in the supplied CISA KEV record for CVE-2025-3935 and the official CVE/NVD references. CISA lists the vendor as ConnectWise, the product as ScreenConnect, dateAdded as 2025-06-02, dueDate as 2025-06-23, and knownRansomwareCampaignUse as Unknown. The source metadata also cites the ConnectWise security bulletin referenced by CISA. No exploit details, affected-version claims, or CVSS score were provided in the supplied corpus.

Official resources

Public defensive debrief based on official CISA KEV, CVE, and NVD references. No exploit instructions or weaponized details included.