NewsCompaniesFlawsGuides
Get the app
HighFixedBeing used in attacksClosedUpdated

ConnectWise ScreenConnect path traversal CVE-2024-1708 added to CISA's exploited list, used by ransomware

CISA says ScreenConnect flaw CVE-2024-1708 is used in attacks, including by ransomware gangs. A fix has existed since Feb 2024 (23.9.8). If you or your IT provider run self-hosted ScreenConnect, confirm it is on 23.9.8 or later.

What to do

If you or your IT provider run a self-hosted ScreenConnect server, check it is on version 23.9.8 or later, review its user accounts and logs, change passwords and turn on multi-factor authentication. Cloud-hosted ScreenConnect needs no action from you.

What’s happening

CVE-2024-1708 is a path traversal flaw in self-hosted ConnectWise ScreenConnect, the remote-access tool many IT providers use, that lets an attacker reach files that should be out of bounds. ConnectWise rates it CVSS 8.4 and says it affects versions 23.9.7 and earlier. The fix, version 23.9.8, was released on 19 February 2024 together with a fix for a more severe companion flaw, CVE-2024-1709. ConnectWise says it remediated its own cloud-hosted service (screenconnect.com and hostedrmm.com) and that partners there need take no action. CISA listed CVE-2024-1708 as being used in attacks on 28 April 2026, flagging use by ransomware gangs. Reporting on Microsoft's research says the China-based group Storm-1175, which deploys Medusa ransomware, has exploited both ScreenConnect flaws. ConnectWise's bulletin says that in the 2024 bulletin the flaw required high privileges and user interaction. Self-hosted servers that were never updated remain exposed. Whether any particular victims were hit through this flaw specifically is not stated in the sources read.

What
Flaw
Affects
ConnectWise ScreenConnect (self-hosted)
Affected
ConnectWise ScreenConnect 23.9.7 and prior (self-hosted)
Fixed in
23.9.8 or later
22.4.20001 (interim patch for partners not under maintenance; ConnectWise says it fixes CVE-2024-1709)
CVE
CVE-2024-1708
Since
28 Apr 2026
Closed
28 Apr 2026

Timeline

  1. CISA added

    CISA listed CVE-2024-1708 as a flaw being used in attacks, including by ransomware gangs. The date comes from the brief and search summaries; CISA's own entry was not read directly.

  2. Wider attacks

    BleepingComputer reported Microsoft's finding that Storm-1175, a China-based group that deploys Medusa ransomware, has exploited both ScreenConnect flaws (CVE-2024-1708 and CVE-2024-1709) among more than 16 vulnerabilities.

  3. CISA added

    After reports of attacks, CISA added the companion flaw CVE-2024-1709 to its list of exploited vulnerabilities, and ConnectWise began suspending unpatched self-hosted servers. CVE-2024-1708 was not listed then.

  4. Made publicFixed

    ConnectWise published its bulletin for self-hosted ScreenConnect 23.9.7 and earlier, covering CVE-2024-1708 (path traversal, CVSS 8.4) and CVE-2024-1709 (authentication bypass, CVSS 10). The fix shipped in 23.9.8.

Sources

  1. ConnectWise ScreenConnect 23.9.8 security bulletinConnectWise · 19 Feb 2024
  2. Microsoft links Medusa ransomware affiliate to zero-day attacksBleepingComputer · 6 Apr 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from April 2026 · JSON · RSS