CVE-2024-1708: ConnectWise ScreenConnect path traversal enabling remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityIt is in CISA KEV with known ransomware use, has a very high EPSS score, and public exploit references exist, so it is being actively exploited.

What it is

ConnectWise ScreenConnect 23.9.7 and earlier contain a path-traversal flaw (CWE-22) that can let an attacker execute remote code or reach confidential data and critical systems. It matters because ScreenConnect is a remote-support tool, so compromise gives an attacker a foothold on managed endpoints and the systems that control them.

Impact

An attacker can run code on the affected server or reach confidential data and critical systems, potentially taking over the remote-support infrastructure and the endpoints it manages.

Attack surface

The flaw is network-reachable (AV:N) and requires high privileges (PR:H) plus user interaction (UI:R) per the CVSS vector, so it is not a simple unauthenticated hit. The description does not state the exact entry point, so defenders should treat any privileged ScreenConnect workflow as the likely path.

Exploitation

CISA added it to KEV with a due date of 2026-05-12 and flags known ransomware campaign use, and EPSS gives a 30-day probability of 0.9549 (99.867th percentile). Reference tags include Exploit, so public exploitation material exists.

What to do

• Upgrade ConnectWise ScreenConnect to 23.9.8 or later as the vendor advisory directs.
• If immediate patching is not possible, apply the vendor's stated mitigations or take the instance off the internet until it is fixed.
• Restrict ScreenConnect administrative and privileged access to trusted accounts and networks.
• Review exposed ScreenConnect instances for signs of compromise before and after patching.
• Follow BOD 22-01 guidance for cloud services if the instance is cloud-hosted.

Detection

• Hunt for path-traversal patterns such as ../ sequences in ScreenConnect web or application logs.
• Monitor for unexpected child processes or command execution spawned by the ScreenConnect service.
• Alert on unusual outbound connections or new accounts created from ScreenConnect hosts.
• Correlate ScreenConnect access logs with known exploitation indicators from the vendor and third-party advisories.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.