CVE-2023-47257

⚠️ high

ConnectWise ScreenConnect through 23.8.4 allows man-in-the-middle attackers to achieve remote code execution via crafted messages.

CVSS Score

8.1

High

EPSS Score

5.0

Exploit Probability

Published Date

2024-02-01

First Seen: 2026-01-05

This CVE is High Risk - more severe than 76.7% of all 360,673 vulnerabilities in our database.

#84,107

Top 25% most severe

Severity Percentile

🔍 Exploitation Status

None

No known exploits

⚙️ Automatable

Requires human interaction

💥 Technical Impact

Total

Complete system compromise possible

SSVC data provided by CISA

Last Modified 2025-05-07

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE IDs (Weakness Types)

CWE-94

📦 Affected Products 2

Vendor	Product	Status	Affected Versions
connectwise	automate	Affected	v-
connectwise	screenconnect	Affected	< 23.8.5

Vendor Advisory

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-84869	⛔ critical	9.9	0.7	A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session ...	2026-09-08
CVE-2026-11596	🔶 medium	4.7	0.2	In ScreenConnect™ versions prior to 26.2, input validation within the Host Pass creation functionality could allow an ...	2026-06-10
CVE-2026-9089	⚠️ high	8.8	0.3	The ConnectWise Automate™ Agent does not fully verify the authenticity of components obtained during plugin loading an...	2026-05-21
CVE-2025-14823	🔶 medium	5.3	0.0	In deployments using the ScreenConnect™ Certificate Signing Extension, encrypted configuration values including an Azu...	2025-12-18
CVE-2025-14265	⛔ critical	9.1	0.1	In versions of ScreenConnect™ prior to 25.8, server-side validation and integrity checks within the extension subsyste...	2025-12-11
CVE-2025-11492	⛔ critical	9.6	0.0	In the ConnectWise Automate Agent, communications could be configured to use HTTP instead of HTTPS. In such cases, an on...	2025-10-16

These CVEs affect the same products