Is CVE-2025-3935 (ConnectWise ScreenConnect Improper Authentication) being exploited in the wild?

Yes. CISA added CVE-2025-3935 to its Known Exploited Vulnerabilities catalogue on 2 June 2025, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. ConnectWise ScreenConnect contains an improper authentication vulnerability. Any organisation running the affected product should treat remediation as urgent. Check exposure first, then patch or mitigate, then review logs for signs of earlier compromise.

What “being exploited in the wild” means for this CVE

For this question, the important point is not just that ConnectWise ScreenConnect has an improper authentication flaw, but that CISA has already placed it in the KEV catalogue. That means defenders should treat it as an active exploitation issue, not a theoretical product bug. The practical response is exposure validation, urgent remediation, and compromise review.

Because KEV inclusion is a high-confidence signal, the first decision is whether the product is reachable, deployed, and actually exposing the vulnerable authentication path. If it is, the risk is immediate even before you confirm whether your own environment has shown signs of abuse. Use the vendor advisory and the CISA Known Exploited Vulnerabilities Catalog for authoritative remediation details.

For vulnerability triage at this stage, the useful question is whether this is a single-instance administrative tool, a broadly exposed remote access service, or something embedded in a larger support workflow. A remotely reachable access product with weak authentication assumptions can become a fast initial access path, especially when exposed on the internet or shared across multiple environments.

Why improper authentication becomes urgent on remote access tooling

Improper authentication defects are dangerous because they can collapse the trust boundary that is supposed to separate unauthenticated traffic from privileged session creation. In a remote support or remote administration platform, that can turn a login flaw into direct access to endpoints, support consoles, or downstream administrative functions.

The immediate security concern is usually not just unauthorised entry, but what follows after entry. Attackers who gain access to a remote management tool often look for session material, connected systems, stored credentials, or privileged actions they can trigger from inside the platform. That is why a KEV-listed auth flaw deserves the same urgency as a perimeter break-in.

Even when there is no ransomware linkage, the exposure can still support credential theft, lateral movement, or silent persistence. The right frame is therefore exposure plus potential blast radius, not only the product defect itself. The CISA KEV catalogue is the authoritative signal for that urgency, while the FIRST EPSS model is useful when you need to compare this issue against the rest of your backlog.

What to do before and after patching

Start with exposure confirmation, then move to fix deployment, then verify whether the flaw was already used against your environment. For a product in this class, delaying patching while waiting for certainty about compromise is usually the wrong trade-off. If the service is internet-facing or broadly reachable internally, remediation should be treated as an urgent change.

When patching cannot happen immediately, reduce reachability first. Restrict network access, place the service behind tighter administrative controls, and remove any unnecessary exposure paths that let unauthenticated users reach the product. If you have compensating controls, make sure they are real enforcement points, not just policy statements.

After mitigation or patching, review authentication events, admin actions, new sessions, configuration changes, and any indicators that suggest the product was used as an initial access point. If the product stores credentials, tokens, or session material that could have been exposed through the flaw, rotate them promptly and review adjacent systems for reuse. The Zero-Day and Exploited Vulnerabilities Guide gives a useful playbook for this kind of emergency triage, and the Vulnerability Management Guide is the better reference when you need to formalise prioritisation, exceptions, and verification.

Risk and Threat Considerations

The main risk is that a remotely exploitable authentication flaw can become a high-value initial access path with little warning. Once an attacker can cross the authentication boundary, the product may be used as a staging point for broader access, session theft, or operational disruption.

Failure mechanism: The authentication control fails open or is bypassed in a way that lets unauthorised users create or hijack access without valid credentials.

Impact: Attackers can reach administrative functions or downstream systems, which can lead to persistence, data exposure, service abuse, or further compromise of connected environments.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.

Framework	Control / Reference	Relevance
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	ScreenConnect CVE response depends on rapid flaw remediation for an actively exploited auth issue.
	AC-17 — Remote Access	ScreenConnect is remote access software, so remote access restrictions directly affect exposure.
	AU-6 — Audit Review, Analysis, and Reporting	Post-exploitation review depends on analysing auth and admin logs for signs of abuse.
Recommendation — Prioritise fixing the vulnerable product and track remediation to completion. Restrict remote access paths until remediation is complete. Review logs for anomalous access and administrative activity after exposure.
ISO/IEC 27001:2022	A.8.8 — Management of technical vulnerabilities	This CVE requires urgent vulnerability handling, verification, and remediation governance.
Recommendation — Triage, remediate, and verify technical vulnerabilities on an urgent basis.
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Active exploitation makes continuous vulnerability management the core control response.
Recommendation — Scan, prioritise, and remediate the exposed product immediately.

Practitioner Guidance

What to verify: Confirm whether any instance is reachable from untrusted networks, whether it is still unpatched, and whether logs show anomalous logins, session creation, or configuration changes around the CISA KEV date.

Decision rule: If the product is exposed and business-critical, prioritise containment and remediation over normal maintenance sequencing; if you cannot patch immediately, shorten the exposure window by restricting access and increasing monitoring.

What practitioners underestimate: The compromise path often matters more than the exact vulnerability type. With remote access software, one successful auth bypass can create a trusted foothold that is harder to detect than a noisy exploit attempt.

Practitioner takeaway: Treat KEV listing as a live exploitation signal, not a background vulnerability note, and assume the safest response is to prove exposure, close the access path, and then hunt for earlier abuse.