High severity · published Feb 21, 2024
CVE-2024-1708
Improper limitation of a pathname to a restricted directory (“path traversal”)
RansomwareIn wildKEV
8.4
CVSS
95.4%
EPSS
Yes
On KEV
Description
ConnectWise ScreenConnect 23.9.7 and prior are affected by path-traversal vulnerability, which may allow an attacker
the ability to execute remote code or directly impact confidential data or critical systems.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)95.4% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Apr 28, 2026
Federal remediation dueMay 12, 2026
Ransomware campaign useKnown
Affected products
Which versions
SC
ScreenConnect · ConnectWise
through 23.9.7 · source: vendor, NVD, KEV
In the news
VulnerabilityHigh
CISA Adds Actively Exploited ConnectWise and Windows Flaws to KEV
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added two security flaws impacting ConnectWise ScreenConnect and Microsoft Windows to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation.
The vulnerabilities are listed below -
CVE-2024-1708 (CVSS score: 8.4) - A path traversal vulnerability in ConnectWise ScreenConnect
Apr 29, 2026·The Hacker News
VulnerabilityHigh
[CISA KEV] CVE-2024-1708: ConnectWise ScreenConnect - ConnectWise ScreenConnect Path Traversal Vulnerability
ConnectWise ScreenConnect contains a path traversal vulnerability which could allow an attacker to execute remote code or directly impact confidential data and critical systems.
SCScreenConnectCVE-2024-1708
Apr 28, 2026·CISA KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-1708
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-1708
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
www.connectwise.com
https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
www.huntress.com
https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
More from ScreenConnect
10.0
CVE-2024-1709
Authentication bypass using an alternate path or channel
9.9
CVE-2026-84869
ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions
7.2
CVE-2025-3935
ScreenConnect Exposure to ASP.NET ViewState Code Injection
9.8
CVE-2023-25718
In ConnectWise Control through 22.9.10032 (formerly known as ScreenConnect), after an executable file is signed, additional instructions can be added without invalidating the…
9.8
CVE-2019-16517
An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185