{"id":"screenconnect-path-traversal-cve-2024-1708-apr-2026","category":"patch","status":"closed","title":"ConnectWise ScreenConnect path traversal CVE-2024-1708 added to CISA's exploited list, used by ransomware","tldr":"CISA says ScreenConnect flaw CVE-2024-1708 is used in attacks, including by ransomware gangs. A fix has existed since Feb 2024 (23.9.8). If you or your IT provider run self-hosted ScreenConnect, confirm it is on 23.9.8 or later.","summary":"CVE-2024-1708 is a path traversal flaw in self-hosted ConnectWise ScreenConnect, the remote-access tool many IT providers use, that lets an attacker reach files that should be out of bounds. ConnectWise rates it CVSS 8.4 and says it affects versions 23.9.7 and earlier. The fix, version 23.9.8, was released on 19 February 2024 together with a fix for a more severe companion flaw, CVE-2024-1709. ConnectWise says it remediated its own cloud-hosted service (screenconnect.com and hostedrmm.com) and that partners there need take no action. CISA listed CVE-2024-1708 as being used in attacks on 28 April 2026, flagging use by ransomware gangs. Reporting on Microsoft's research says the China-based group Storm-1175, which deploys Medusa ransomware, has exploited both ScreenConnect flaws. ConnectWise's bulletin says that in the 2024 bulletin the flaw required high privileges and user interaction. Self-hosted servers that were never updated remain exposed. Whether any particular victims were hit through this flaw specifically is not stated in the sources read.","action":"If you or your IT provider run a self-hosted ScreenConnect server, check it is on version 23.9.8 or later, review its user accounts and logs, change passwords and turn on multi-factor authentication. Cloud-hosted ScreenConnect needs no action from you.","product":"ConnectWise ScreenConnect (self-hosted)","audience":"work","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2024-1708"],"tags":["connectwise","screenconnect","path-traversal","ransomware","cisa-kev","remote-access","medusa"],"affected":["ConnectWise ScreenConnect 23.9.7 and prior (self-hosted)"],"fixed":["23.9.8 or later","22.4.20001 (interim patch for partners not under maintenance; ConnectWise says it fixes CVE-2024-1709)"],"matches":[],"sources":[{"kind":"advisory","title":"ConnectWise ScreenConnect 23.9.8 security bulletin","url":"https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8","by":"ConnectWise","date":"2024-02-19"},{"kind":"news","title":"Microsoft links Medusa ransomware affiliate to zero-day attacks","url":"https://bleepingcomputer.com/news/security/microsoft-links-medusa-ransomware-affiliate-to-zero-day-attacks/","by":"BleepingComputer","date":"2026-04-06"}],"started":"2026-04-28","closed":"2026-04-28","created":"2026-11-03T21:48:53.037Z","updated":"2026-11-03T21:48:53.037Z","cve_notes":[{"cve":"CVE-2024-1708","name":"Path traversal in ConnectWise ScreenConnect","what":"A path traversal flaw in self-hosted ScreenConnect that could let an attacker read or reach files outside the intended folders, and which CISA says can lead to remote code execution or exposure of confidential data.","severity":"high","cvss":8.4}],"timeline":[{"at":"2026-04-28","added":"2026-11-03T21:46:16.197Z","kind":"cisa-added","text":"CISA listed CVE-2024-1708 as a flaw being used in attacks, including by ransomware gangs. The date comes from the brief and search summaries; CISA's own entry was not read directly.","url":"https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8","by":"CISA (via search summaries)","patch":null},{"at":"2026-04-06","added":"2026-11-03T21:46:16.197Z","kind":"wider-attacks","text":"BleepingComputer reported Microsoft's finding that Storm-1175, a China-based group that deploys Medusa ransomware, has exploited both ScreenConnect flaws (CVE-2024-1708 and CVE-2024-1709) among more than 16 vulnerabilities.","url":"https://bleepingcomputer.com/news/security/microsoft-links-medusa-ransomware-affiliate-to-zero-day-attacks/","by":"BleepingComputer","patch":null},{"at":"2024-02-22","added":"2026-11-03T21:46:16.197Z","kind":"cisa-added","text":"After reports of attacks, CISA added the companion flaw CVE-2024-1709 to its list of exploited vulnerabilities, and ConnectWise began suspending unpatched self-hosted servers. CVE-2024-1708 was not listed then.","url":"https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8","by":"ConnectWise","patch":null},{"at":"2024-02-19","added":"2026-11-03T21:46:16.197Z","kind":"disclosed","text":"ConnectWise published its bulletin for self-hosted ScreenConnect 23.9.7 and earlier, covering CVE-2024-1708 (path traversal, CVSS 8.4) and CVE-2024-1709 (authentication bypass, CVSS 10). The fix shipped in 23.9.8.","url":"https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8","by":"ConnectWise","patch":"patched"}],"url":"https://hard.fyi/live/screenconnect-path-traversal-cve-2024-1708-apr-2026/","json":"https://hard.fyi/api/live?id=screenconnect-path-traversal-cve-2024-1708-apr-2026"}