ConnectWise has disclosed that it is planning to rotate the digital code signing certificates used to signal ScreenConnect, ConnectWise Automate, and ConnectWise distant monitoring and administration (RMM) executables attributable to security issues.
The corporate stated it is doing so “attributable to issues raised by a third-party researcher about how ScreenConnect dealt with sure configuration information in earlier variations.”
Whereas the corporate didn’t publicly elaborate on the character of the issue, it has shed extra gentle in a personal FAQ accessible solely to its prospects (and later shared on Reddit) –
The priority stems from ScreenConnect utilizing the flexibility to retailer configuration information in an accessible space of the installer that’s not signed however is a part of the installer. We’re utilizing this potential to cross down configuration info for the connection (between the agent and server) such because the URL the place the agent ought to name again with out invalidating the signature. The unsigned space is utilized by our software program and others for personalization, nonetheless, when coupled with the capabilities of a distant management resolution, it might create an insecure design sample by as we speak’s security requirements.
Apart from issuing new certificates, the corporate stated it is releasing an replace that is designed to enhance how the aforementioned configuration information is managed in ScreenConnect.
The revocation of digital certificates is anticipated to happen by June 13 at 8 p.m. ET (June 14, 12 a.m. UTC). ConnectWise has emphasised that the problem doesn’t contain a compromise of its programs or certificates.
It is value noting that robotically ConnectWise is already within the strategy of updating certificates and brokers throughout all its cloud situations of Automate and RMM.
Nevertheless, these utilizing on-premise variations of ScreenConnect or Automate are required to replace to the most recent construct and validate that each one brokers are up to date earlier than the cutoff date to keep away from any doable service disruptions.
“We had already deliberate enhancements to certificates administration and product hardening, however these efforts at the moment are being applied on an accelerated timeline,” ConnectWise stated. We perceive this will create challenges and are dedicated to supporting you thru the transition.”
The event comes merely days after the corporate disclosed {that a} suspected nation-state risk actor breached its programs and affected a small variety of its prospects by exploiting CVE-2025-3935 to conduct ViewState code injection assaults.
It additionally comes as attackers are more and more counting on official RMM software program like ScreenConnect and others to acquire stealthy, persistent distant entry, successfully permitting them to mix in with regular exercise and fly underneath the radar.
This assault methodology, known as living-off-the-land (LotL), makes it doable to hijack the software program’s inherent capabilities for distant entry, file switch, and command execution.
