CVE-2023-47257 is a code injection flaw in ConnectWise ScreenConnect through version 23.8.4. NVD scores it 8.1, High. A man-in-the-middle attacker could achieve remote code execution with crafted messages. ConnectWise's bulletin tells on-premise customers to upgrade to 23.8.5 and update their guest clients to the same version.
What's affected
NVD describes ConnectWise ScreenConnect through 23.8.4. It also lists ConnectWise Automate as a product entry. ConnectWise's security bulletin, dated 20 November 2023, says ScreenConnect versions 23.8 and earlier are affected, along with ConnectWise Automate cloud instances where ScreenConnect is installed.
The fix for on-premise servers is ScreenConnect 23.8.5. Cloud instances were being updated automatically on a rolling schedule, and administrators could force the update from cloud.screenconnect.com.
Source conflict on severity: NVD scores the CVE 8.1, High, with a vector that marks attack complexity as High because the attacker must sit in the network path (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). ConnectWise's own bulletin uses its own scale instead, rating it Important with Priority 1 (High). Both agree the issue deserves a fast update. Source conflict on versions: the record says through 23.8.4, while the bulletin says 23.8 and earlier. Treat anything below 23.8.5 as in scope.
The same bulletin also covers CVE-2023-47256, a separate flaw where local users can connect to arbitrary relay servers through implicit trust of proxy settings. The upgrade covers both.
How to check if you're exposed
Open the ScreenConnect administration page and read the server version. Anything below 23.8.5 on an on-premise server needs the upgrade.
The bulletin says guest clients must be updated to the server version as well, so a server upgrade alone is not the whole job. Check the version of access agents installed on managed machines, and reinstall or upgrade the ones that lag behind. Cloud customers should confirm in the cloud portal that the instance has already moved to the fixed release.
If you run ConnectWise Automate with the ScreenConnect plugin, follow the plugin upgrade steps in the bulletin to check whether a new build has been released for your installation.
What to do now
- Upgrade on-premise ScreenConnect servers to 23.8.5 or later, following ConnectWise's upgrade steps.
- Update guest clients and access agents to the same version as the server. The bulletin lists this as part of the remediation.
- For cloud instances, confirm the automatic update has run, or start it from the cloud portal.
- Where the plugin is in use with Automate, check for a newer ScreenConnect build through the plugin upgrade steps.
- Review where your remote support traffic crosses networks you do not control, and prefer encrypted paths you manage. That narrows the number of places a man-in-the-middle position is possible.
Why it matters
The weakness is CWE-94, improper control of generation of code. In plain terms, the product accepts messages from the network and, under the right conditions, treats part of their content as something to run. The record does not publish more detail than that, and neither does the bulletin, so this post will not guess at the mechanism.
The man-in-the-middle requirement is what keeps the NVD score at 8.1 and not higher. An attacker has to be positioned between the parties and able to alter traffic. That is harder than a plain internet request, but remote support tools exist to cross networks, and the machines they manage are often the ones with the most access. ConnectWise gave this priority 1 in its own scale, which it defines as being targeted or at higher risk of being targeted in the wild. The CISA Known Exploited Vulnerabilities flag in the record is false for this CVE, and the bulletin does not say it is exploited.
Quick check
Does a cloud-hosted ScreenConnect instance need action?
ConnectWise says cloud instances were being updated automatically on a rolling schedule. Administrators could force the update from the cloud portal, and guest clients and agents still need to match the server version.
Is CVE-2023-47257 on the CISA KEV list?
No. The record's kev flag is false, and the bulletin does not report exploitation.
Sources
Last reviewed: 19 October 2026.
