Validating the Bishop Fox Findings in ConnectWise Control | Huntress

**Executive Summary:** Bishop Fox disclosed eight vulnerabilities in ConnectWise Control including stored XSS, CORS misconfiguration, CSRF, PII and user-enumeration disclosures, a malicious-extension remote code execution, missing security headers, and insecure cookie scope; the report summarizes each finding, assigns CVEs where applicable, and documents ConnectWise’s mitigating actions (some fully mitigated, some partially mitigated, and some still pending).