Reported by 3 outlets
CISA adds ConnectWise ScreenConnect (CVE-2024-1708) to Known Exploited Vulnerabilities catalog
Why this score
- Breadth
- 1.50 / 2.0 · 3 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 5.00 / 5.0 · CVSS + KEV signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
CVE-2024-1708 is a pre-authentication path traversal in ConnectWise ScreenConnect versions 23.9.7 and earlier (CWE-22, CVSS 8.4). CISA added it to the Known Exploited Vulnerabilities catalog on April 28, confirming active in-the-wild exploitation; the advisory originally disclosed the pairing with CVE-2024-1709 (authentication bypass, CVSS 10.0) on February 19, 2024, after independent researchers reported it through the ConnectWise Trust Center on February 13. The bug allows unauthenticated remote attackers to access restricted files, modify application data, and potentially achieve remote code execution through the server's privileged endpoint-access role, which is why the event notes it provides a direct pathway for lateral movement rather than a simple information leak.
A defender who reads only the event list might miss why this matters more than the thirty other CVEs queued the same day. ScreenConnect is the remote-access backbone for managed service providers and IT departments, not a peripheral tool; Shadowserver currently tracks nearly 6,000 internet-exposed instances, and the advisory notes that the vulnerability affects both cloud-hosted and on-premises deployments. Because ScreenConnect agents run with privileged endpoint access, a single compromised server becomes an initial-access broker's entry point into multiple client networks. The update event describes a separate, unassigned-CVE file-transfer behavior issue that ConnectWise is patching separately, which means defenders are now managing two concurrent ScreenConnect risks: the confirmed KEV path traversal and an active file-transfer exposure that requires temporarily deselecting the TransferFiles (or TransferFilesInSession) permission for every session group role until a permanent fix arrives.
Remediation is exact, not approximate. On-prem partners must upgrade to 23.9.8 or higher following the prescribed path: 2.1 to 2.5 to 3.1 to 4.4 to 5.4 to 19.2 to 22.8 to 23.3 to 23.9.8 or later. Partners off maintenance are eligible to install version 22.4.20001 as an interim step for CVE-2024-1709, but 23.9.8 is the full remediation. Before bringing any server back online, review file systems and enhanced Windows event logs for webshell commands or other compromise indicators, check for unknown internal user accounts, and compare network traffic against the published IOCs: 155.133.5.15, 155.133.5.14, and 118.69.65.60. For the new file-transfer vulnerability, log in to the ScreenConnect Administration page, navigate to Administration > Security > Roles, edit each role's session groups, deselect TransferFiles or TransferFilesInSession in the Scoped Permissions window, save, and repeat for all roles. The Mandiant ConnectWise ScreenConnect Remediation and Hardening Guide provides the additional hardening steps and forensic triage framework.
Watch for the assignment of a CVE ID to the file-transfer vulnerability and any new IOCs tied to the path traversal beyond the three addresses already published. Also watch Shadowserver's exposure count: if the nearly 6,000 exposed instances do not drop sharply after the CISA KEV notice, that indicates patch adoption lag in the MSP sector, which is the primary exposure surface for this platform.
Timeline
-
original reporting
CISA adds ConnectWise ScreenConnect (CVE-2024-1708) to Known Exploited Vulnerabilities catalog
cyberpress.org · 168d ago · April 29th, 2026
CISA added the ConnectWise ScreenConnect path traversal vulnerability to its KEV catalog on April 28, confirming active in-the-wild exploitation. The pre-auth path traversal flaw (CWE-22) allows unauthenticated remote attackers to access sensitive system files, modify application data, and potentially achieve remote code execution — providing a direct pathway for lateral movement in enterprise environments. Federal agencies must remediate under BOD 22-01, and CISA is urging private sector organizations to treat it with equal urgency. ScreenConnect's privileged access to endpoints makes it a high-value target for initial access brokers and ransomware operators.
-
update from connectwise.com
ConnectWise ScreenConnect 23.9.8 security bulletin (CVE-2024-1708 / CVE-2024-1709)
connectwise.com · 968d ago · February 19th, 2024
The original ConnectWise security bulletin, published February 19, 2024, discloses both CVE-2024-1708 (path traversal, CWE-22, CVSS 8.4) and CVE-2024-1709 (authentication bypass, CWE-288, CVSS 10.0) in ScreenConnect 23.9.7 and earlier. The bulletin states vulnerabilities were reported through the ConnectWise Trust Center disclosure program on February 13, 2024, validated by February 14, and that CISA added CVE-2024-1709 to its KEV Catalog on February 22, 2024. Affected on-prem instances must upgrade to 23.9.8 or later, with updated builds also provided for versions 22.4 through 23.9.7. The advisory includes IOCs (IP addresses 155.133.5.15, 155.133.5.14, 118.69.65.60) and a specific upgrade path: 2.1 to 2.5 to 3.1 to 4.4 to 5.4 to 19.2 to 22.8 to 23.3 to 23.9.8+.
-
update from bleepingcomputer.com
ConnectWise warns of new ScreenConnect flaw without patch
bleepingcomputer.com · 36d ago · September 7th, 2026
ConnectWise has shared temporary mitigation measures for a new ScreenConnect Remote Access vulnerability that it plans to patch later this week. ScreenConnect is an on-premises or cloud-hosted remote access platform typically used by managed service providers (MSPs), IT departments, and support teams for troubleshooting, patching, and system maintenance. The security flaw affects both cloud and on-premises deployments, and it has not yet received a CVE ID for easy tracking. "ConnectWise has identified an issue affecting file transfer behavior in ScreenConnect® Remote Access Support and Access sessions," the company said in a security advisory issued on Thursday. While ConnectWise is still working on a permanent fix for this security issue, it provided temporary mitigation steps designed to help block potential attacks. This requires IT administrators to go through the following steps: Log in to the ScreenConnect Administration page. Go to Administration > Security > Roles. Edit user roles and check session groups (in bold)with permissions assigned to them. In the Scoped Permissions window, deselect the TransferFiles permission (or TransferFilesInSession for legacy) for each session group. Save changes and repeat for all roles. Internet security watchdog Shadowserver currently tracks nearly 6,000 ScreenConnect instances exposed online. However, there is no information regarding how many of these systems are honeyposts or have already been secured. Internet-exposed ScreenConnec