CVE-2024-1708
ConnectWise ScreenConnect Path Traversal Vulnerability
Published Feb 21, 2024 · updated Jun 17, 2026 · ConnectWise ScreenConnect
ConnectWise ScreenConnect 23.9.7 and prior are affected by path-traversal vulnerability, which may allow an attacker the ability to execute remote code or directly impact confidential data or critical systems.
Timeline
Detection, updates, and resolution for this record.
Feb 21, 2024 · Catalog
Detected
ConnectWise ScreenConnect 23.9.7 and prior are affected by path-traversal vulnerability, which may allow an attacker the ability to execute remote code or directly impact confidential data or critical systems.
Apr 28, 2026 · CISA KEV
Known exploited
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
May 12, 2026 · CISA KEV
Remediation due
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Jun 17, 2026 · Catalog
Updated
ConnectWise ScreenConnect 23.9.7 and prior are affected by path-traversal vulnerability, which may allow an attacker the ability to execute remote code or directly impact confidential data or critical systems.
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA due date May 12, 2026
Affected
- cpe connectwise/screenconnectversion unspecified
- vendor ConnectWise ScreenConnectversion unspecified
Sources
- CISA KEVCVE-2024-1708
ConnectWise ScreenConnect contains a path traversal vulnerability which could allow an attacker to execute remote code or directly impact confidential data and critical systems.
cisa.gov - CVE.orgCVE-2024-1708
Official CVE identifier
cve.org - FIRST EPSSCVE-2024-1708
30-day exploitation probability 95.4%
first.org - Metasploit Modulesexploit_multi/http/connectwise_screenconnect_rce_cve_2024_1709
Public module reference (excellent). Module source is not copied into this catalog.
rapid7.com - NIST NVDCVE-2024-1708
ConnectWise ScreenConnect 23.9.7 and prior are affected by path-traversal vulnerability, which may allow an attacker the ability to execute remote code or directly impact confidential data or critical systems.
nvd.nist.gov