Actively exploited · Published Feb 21, 2024 · Assigned by cisa-cg
CVE-2024-1708Improper limitation of a pathname to a restricted directory (“path traversal”)
High 8.4 Exploited Ransomware
In plain English
A high-severity path traversal in ScreenConnect from ConnectWise. Attackers are actively exploiting it in the wild (listed by CISA on April 28, 2026). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 95.4% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by May 12, 2026.
Official description
ConnectWise ScreenConnect 23.9.7 and prior are affected by path-traversal vulnerability, which may allow an attacker the ability to execute remote code or directly impact confidential data or critical systems.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ConnectWise | ScreenConnect | 0 – through 23.9.7 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
References
- https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
- https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
- https://www.microsoft.com/en-us/security/blog/2026/04/06/storm-1175-focuses-gaze-on-vulnerable-web-facing-assets-in-high-tempo-medusa-ransomware-operations/ third-party-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-1708 government-resource