ConnectWise ScreenConnect Remote Code Execution Vulnerability via ViewState Code Injection (CVE-2025-3935)
Executive & SecOps Summary
SECOPS ASSESSMENTConnectWise ScreenConnect versions 25.2.3 and earlier
If machine keys are compromised by an attacker with privileged system-level access, they can inject a malicious ViewState to execute arbitrary code on the server
Immediately upgrade to ScreenConnect 2025.4, which completely disables ViewState and removes its dependency
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
ConnectWise has released ScreenConnect 2025.4, which disables ViewState and removes any dependency on it. Update your installation immediately using the following commands.
# Example: Updating ScreenConnect Host on Linux
wget 'https://download.screenconnect.com/ScreenConnect_2025.4_Release.tar.gz'
tar -xzvf ScreenConnect_2025.4_Release.tar.gz
cd ScreenConnect_2025.4_Install
sudo ./install.sh2. Temporary Workaround & Hardening Configuration
If an immediate upgrade is not possible, rotate the machine keys in your web.config to invalidate any potentially compromised keys, and enforce ViewState encryption.
<!-- web.config hardening snippet -->
<configuration>
<system.web>
<pages viewStateEncryptionMode='Always' />
<machineKey validation='SHA1' validationKey='AutoGenerate,IsolateApps' decryptionKey='AutoGenerate,IsolateApps' />
</system.web>
</configuration>3. Log Audit & IoC Verification Commands
Verify the installed version of ScreenConnect and inspect IIS logs for anomalous POST requests targeting pages utilizing ViewState.
# Check installed ScreenConnect version on Windows
Get-ItemProperty -Path 'HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*' | Where-Object { $_.DisplayName -like '*ScreenConnect*' } | Select-Object DisplayName, DisplayVersion
# Search IIS logs for potential ViewState manipulation attempts
Select-String -Path 'C:\inetpub\logs\LogFiles\W3SVC1\*.log' -Pattern '__VIEWSTATE'Block Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2025-3935) stems from the platform-level behavior of ASP.NET Web Forms used by ConnectWise ScreenConnect. ASP.NET utilizes ViewState to preserve page and control state, which is Base64-encoded and protected by machine keys. If an attacker gains privileged system-level access and compromises these machine keys, they can forge trusted serialized data, leading to an insecure deserialization (CWE-502) condition.
2. Exploitation Mechanics & Attack Scenario
To exploit this vulnerability, an attacker must first obtain the ASP.NET machine keys (validationKey and decryptionKey) from the host system. Using these compromised keys, the attacker can craft a malicious serialized .NET object payload (e.g., using tools like ysoserial.net), sign and encrypt it to look like a legitimate ViewState, and send it via an HTTP POST request. Upon receiving the request, the server deserializes the payload, resulting in remote code execution (RCE) under the context of the web application process.
3. Infrastructure & Business Impact
This vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild. Successful exploitation allows attackers to gain full control over the ScreenConnect host server, potentially leading to lateral movement, ransomware deployment, and unauthorized access to managed customer endpoints.
Official Vendor Advisories & References
ScreenConnect versions 25.2.3 and earlier versions may be susceptible to a ViewState code injection attack. ASP.NET Web Forms use ViewState to preserve page and control state, with data encoded using Base64 protected by machine keys. It is important to note that to obtain these machine keys, privileged system level access must be obtained. If these machine keys are compromised, attackers could create and send a malicious ViewState to the website, potentially leading to remote code execution on the server. The risk does not originate from a vulnerability introduced by ScreenConnect, but from platform level behavior. This had no direct impact to ScreenConnect Client. ScreenConnect 2025.4 patch disables ViewState and removes any dependency on it.
Frequently Asked SecOps Questions (CVE-2025-3935)
FAQQ1. How critical is CVE-2025-3935 and is it actively exploited in the wild?
CVE-2025-3935 is rated CVSS 7.2 (HIGH) with a 30-day EPSS exploitation probability of 3.6%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2025-3935?
Primary impacted vendors include connectwise across screenconnect. Scope summary: ConnectWise ScreenConnect versions 25.2.3 and earlier (No direct impact to ScreenConnect Client)
Q3. What temporary mitigations or workarounds exist for CVE-2025-3935 before patching?
[Mitigation] Immediately upgrade to ScreenConnect 2025.4, which completely disables ViewState and removes its dependency Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2025-3935
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (connectwise)
View Category →ConnectWise ScreenConnect Client Remote Code Execution (RCE) and Privilege Escalation (CVE-2026-84869)
[Affected Scope] ConnectWise ScreenConnect client software (Servers are not impacted)
JetBrains TeamCity Unauthenticated Remote Code Execution Vulnerability via Agent Polling Protocol (CVE-2026-63077)
[Affected Scope] JetBrains TeamCity versions prior to 2026.1.3 and 2025.11.7
Microsoft SharePoint Server Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-58644, CWE-502)
[Affected Scope] Microsoft SharePoint Server deployments
Microsoft SharePoint Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-50522, CWE-502)
[Affected Scope] Microsoft SharePoint Server deployments
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.