ConnectWise
- Exploited flaws
- 4in 1 product
- Added to CISA's list in 2026
- 21 in 2025
- Used by ransomware
- 2of 4, says CISA
- Disclosure to CISA's list
- Not yet4 of 4 flaws dated so far; filling in daily
Exploited flaws by the year they were disclosed
The year in each CVE ID, roughly when the flaw became public. Recent years can still grow: flaws are often exploited, and listed, years later.
Hover or tab through a year for its count.
Show as a table
| Year disclosed | Exploited flaws |
|---|---|
| 2021 | 0 |
| 2022 | 0 |
| 2023 | 0 |
| 2024 | 2 |
| 2025 | 1 |
| 2026 | 1 |
Products exploited more than once
| Product | Flaws | First listed | Latest |
|---|---|---|---|
| ScreenConnect | 4 | 2024-02-22 | 2026-09-11 |
Latest on CISA's list
In the news
- Microsoft Links Storm-0940 to ConnectWise Supply Chain Attack
- ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants
- Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants
- ConnectWise Resets Credentials as Cloud Backup Remains Offline After Security Incident
From CISA's Known Exploited Vulnerabilities catalogue. "Disclosure to CISA's list" uses NVD's publication date and leaves out the 2021-11-03 launch, when CISA added hundreds of older flaws at once; CISA often lists a flaw after attacks have begun, so it's an upper limit on how fast exploitation came.