Questions Swirl Around ConnectWise Flaw Used in Attacks

ConnectWise disclosed that a suspected nation-state actor breached its ScreenConnect environment; the company patched CVE-2025-3935 (an improper authentication/ViewState injection issue) on April 24 and reported limited customer impact. CISA later added the CVE to its Known Exploited Vulnerabilities catalog, Mandiant is assisting the investigation, and public advisories and timelines contain discrepancies about when exploitation was detected.