CVE-2024-1708
ConnectWise ScreenConnect Path Traversal Vulnerability
Published Feb 21, 2024 · updated Jun 17, 2026 · ConnectWise ScreenConnect
ConnectWise ScreenConnect 23.9.7 and prior are affected by path-traversal vulnerability, which may allow an attacker the ability to execute remote code or directly impact confidential data or critical systems.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Feb 21, 2024 · Catalog
Detected
ConnectWise ScreenConnect 23.9.7 and prior are affected by path-traversal vulnerability, which may allow an attacker the ability to execute remote code or directly impact confidential data or critical systems.
Apr 28, 2026 · CISA KEV
Known exploited
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
May 12, 2026 · CISA KEV
Remediation due
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Jun 17, 2026 · Catalog
Updated
ConnectWise ScreenConnect 23.9.7 and prior are affected by path-traversal vulnerability, which may allow an attacker the ability to execute remote code or directly impact confidential data or critical systems.
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA due date May 12, 2026
Affected
- cpe connectwise/screenconnectversion unspecified
- vendor ConnectWise ScreenConnectversion unspecified
Sources
- CISA KEVConfirmed exploitationCVE-2024-1708
ConnectWise ScreenConnect contains a path traversal vulnerability which could allow an attacker to execute remote code or directly impact confidential data and critical systems.
cisa.gov - CVE.orgVulnerability recordCVE-2024-1708
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2024-1708
30-day exploitation probability 95.4%
first.org - Metasploit ModulesPublic exploit moduleexploit_multi/http/connectwise_screenconnect_rce_cve_2024_1709
Public module reference (excellent). Module source is not copied into this catalog.
rapid7.com - NIST NVDVulnerability recordCVE-2024-1708
ConnectWise ScreenConnect 23.9.7 and prior are affected by path-traversal vulnerability, which may allow an attacker the ability to execute remote code or directly impact confidential data or critical systems.
nvd.nist.gov