CVE-2025-3935: ConnectWise ScreenConnect ViewState code injection, exploited in targeted intrusions
The short version: ConnectWise ScreenConnect has a ViewState code-injection flaw (CVE-2025-3935). ASP.NET protects ViewState with server machine keys; an attacker who has obtained those keys can forge a malicious ViewState and reach remote code execution on the server. That precondition — needing privileged access to the keys first — is what separates this from the trivial 2024 bypass. It's in CISA's KEV catalog after use in targeted intrusions. Steady hands: patch and rotate.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — in practice (see below) |
| CVSS v3.1 (NVD) | 7.2 — High · AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| CVSS (ConnectWise, CNA) | 8.1 — High · AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 3.36% · 87.37th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2025-06-23 |
| Known exploited? | Yes — used in targeted intrusions |
| Vulnerability type | CWE-502 deserialization of untrusted data (ViewState) → remote code execution |
| Requires authenticated session? | Effectively yes — the attacker must first obtain the server's machine keys (privileged access) |
| Affected | ScreenConnect 25.2.3 and earlier |
| Fixed in | ScreenConnect 2025.4 (25.2.4) — ViewState removed/dependency dropped |
What you need to know
ASP.NET Web Forms use ViewState to preserve page and control state, encoded and protected with server machine keys. If an attacker gets those keys, they can craft a signed, malicious ViewState the server will trust and deserialize — leading to code execution.
- The keys are the gate. ConnectWise notes that obtaining the machine keys requires privileged, system-level access to the server in the first place. NVD reflects this with PR:H (high privileges required).
- When the gate is open, the impact is full. Deserialization here yields code execution — confidentiality, integrity, and availability all High.
- It was used in the wild. The KEV listing follows targeted intrusions, which is why it's on the must-address list even though the precondition is significant. The fix removed the ViewState mechanism entirely.
How serious we see it
High — with the precondition stated honestly.
The base scores (NVD 7.2, ConnectWise 8.1) land in High, and the two vendors mainly disagree on where the difficulty lives — high privilege (NVD) versus high attack complexity (ConnectWise). Both are telling you the same thing: this isn't a drive-by. An attacker needs the machine keys before ViewState forging is possible. That keeps it below the 2024 unauthenticated bypass in practical urgency — but it's KEV-listed and ends in RCE, so it stays firmly High. The reassuring part: a clean fix exists, and confirming your version is quick.
Recommendations
Straight from ConnectWise's advisory and CISA:
- Patch now. Upgrade ScreenConnect to 2025.4 (25.2.4) or later, which removes the vulnerable ViewState handling.
- Rotate machine keys and secrets if you ran an affected build exposed — especially if you have any indication of prior compromise, since leaked keys are the enabling condition.
- Hunt. Review for signs of prior privileged access to the server and anomalous ViewState-bearing requests.
- Harden exposure. Limit who can reach the ScreenConnect server and keep it on supported builds.
- Confirm your exposure first. Verify whether you run a self-hosted ScreenConnect and which version.
How BreachRisk sees it
BreachRisk discovers internet-facing ScreenConnect from little more than your domain, fingerprints the version, and flags exposure tied to KEV-listed vulnerabilities like this one, ranked up because it's actively exploited. We identify and flag the affected version; we don't exploit it. The outside-in view means an exposed, unpatched ScreenConnect is already on your map — the starting point for prioritizing a patch-and-rotate before someone with the keys acts on it.