PatchTheCVECVE-2019-16516: An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185
CVE-2019-16516 is a medium-severity flaw (CVSS 5.3) affecting control. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. There is a user enumeration vulnerability, allowing an unauthenticated attacker to determine with certainty if an account exists for a given username.
Why this priority
- EPSS top 3%: very likely to be exploited
- Public exploit reference
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 5.3 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 19.1% (top 3%) |
| CISA exploited list | No |
| Weakness | CWE-203 |
| Published | 2020-01-23 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Public exploits and detection
Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2019-16516?
control: upgrade to newer than 19.2.24707. Exact commands for each OS are on this page.
Is CVE-2019-16516 being exploited?
CVE-2019-16516 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2019-16516 affect?
CVE-2019-16516 affects control. Severity is medium (CVSS 5.3). An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. There is a user enumeration vulnerability, allowing an unauthenticated attacker to determine with certainty if an account exists for a given u
How urgent is CVE-2019-16516?
Priority 53/100. EPSS top 3%: very likely to be exploited; Public exploit reference; Remotely exploitable, no login, no user action
Software pages
ConnectWise ScreenConnect vulnerabilities
Related CVEs
- CVE-2023-25719 HIGH 8.8 UPGRADE ConnectWise Control before 22.9.10032 (formerly known as ScreenConnect) fails to validate user-supplied parame
- CVE-2023-25718 CRITICAL 9.8 UPGRADE In ConnectWise Control through 22.9.10032 (formerly known as ScreenConnect), after an executable file is signe
- CVE-2021-36763 HIGH 7.5 UPGRADE UPGRADE In CODESYS V3 web server before 3.5.17.10, files or directories are accessible to External Parties.
- CVE-2021-33485 CRITICAL 9.8 UPGRADE UPGRADE CODESYS Control Runtime system before 3.5.17.10 has a Heap-based Buffer Overflow.
- CVE-2019-16517 CRITICAL 9.8 DOWNGRADE An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185