# CVE-2025-3935: ConnectWise ScreenConnect remote code execution via ViewState injection

Source: https://junglewise.ai/threats/cve-2025-3935-connectwise-screenconnect-remote-code-execution-via-viewstate  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-06-02. Updated: 2026-05-15  
License: CC BY 4.0 with a link back

CVE-2025-3935 · Severity: critical · CVSS 8.1 · Exploited in the wild · Published 2025-06-02

ConnectWise ScreenConnect, a remote desktop and support software, is vulnerable to a security flaw that could allow an attacker to take full control of the server. If an attacker manages to obtain specific system-level encryption keys, they can inject malicious code into the application's state management system. This could result in unauthorized access to sensitive customer data or a complete disruption of remote support operations.

Technologies: [ConnectWise ScreenConnect](https://junglewise.ai/threats/technologies/screenconnect). Vendors: [ConnectWise](https://junglewise.ai/threats/vendors/connectwise).

## Quick answers

**Is CVE-2025-3935 exploited in the wild?** Yes. CVE-2025-3935 is known to be exploited in the wild, first recorded on 2 June 2025. Treat it as urgent.

**How severe is CVE-2025-3935?** Critical severity, with a CVSS score of 8.1, published 2 June 2025.

**Which products and versions are affected?** ConnectWise ScreenConnect 25.2.3 and earlier.

**Is there a fix for CVE-2025-3935?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-3935 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2025-3935?** Check whether you run ConnectWise ScreenConnect at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

ConnectWise ScreenConnect versions 25.2.3 and earlier are vulnerable to a deserialization of untrusted data (CWE-502) via ASP.NET ViewState. While ViewState is typically protected by machine keys, an attacker who has obtained these keys through prior privileged system access can craft a malicious ViewState payload. When processed by the server, this payload can trigger remote code execution. The vulnerability is rooted in platform-level ASP.NET Web Forms behavior rather than a direct coding error in ScreenConnect itself. ConnectWise has released version 2025.4, which mitigates the risk by entirely disabling ViewState and removing dependencies on it. This vulnerability has been observed in the wild.

## Affected products

- ConnectWise ScreenConnect 25.2.3 and earlier

## Timeline

- 2025-04-25: disclosed
- 2025-06-02: kev added: Added to CISA Known Exploited Vulnerabilities catalog
- 2025-06-02: advisory

## Related threats

- [ConnectWise ScreenConnect unauthorized file transfer and execution](https://junglewise.ai/threats/cve-2026-84869-connectwise-screenconnect-unauthorized-file-transfer-and)
- [ConnectWise ScreenConnect improper input validation in Host Pass creation](https://junglewise.ai/threats/cve-2026-11596-connectwise-screenconnect-improper-input-validation-in-host-pass)
- [ConnectWise ScreenConnect path traversal](https://junglewise.ai/threats/cve-2024-1708-connectwise-screenconnect-path-traversal)
- [ConnectWise ScreenConnect improper cryptographic signature verification in server](https://junglewise.ai/threats/cve-2026-3564-connectwise-screenconnect-improper-cryptographic-signature)
- [In versions of ScreenConnect™ prior to 25.8, server-side validation and integrity checks within the extension…](https://junglewise.ai/threats/cve-2025-14265-in-versions-of-screenconnect-prior-to-25-8-server-side-validation)