CVE intelligenceCISA KEVRansomware use

CVE-2024-1708

ConnectWise ScreenConnect Path Traversal Vulnerability

Published Feb 21, 2024Sources checked Oct 28, 2026

8.4HIGHCVSS out of 10

What this means

Actively exploited

CISA lists CVE-2024-1708 in its Known Exploited Vulnerabilities catalog, which means exploitation has been observed. The entry applies to ConnectWise ScreenConnect.

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Public exploit: Cataloged public exploit.

Rapid7 Metasploit: ConnectWise ScreenConnect Unauthenticated Remote Code Execution (2026-09-23 21:40:29.350562+00)
Rapid7 catalogs an exploit module for this CVE. Module availability does not establish exploitation in the wild or applicability to your environment.

CISA KEVListedObserved exploitation

EPSS95.4%Estimated 30-day exploitation probability

Ransomware useReported by CISACISA KEV ransomware field

Threat actors1Source-linked actor relationships

Overview

What is CVE-2024-1708?

ConnectWise ScreenConnect 23.9.7 and prior are affected by path-traversal vulnerability, which may allow an attacker

the ability to execute remote code or directly impact confidential data or critical systems.

Source: NVD

CISA says:Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.CISA catalog due date May 12, 2026