Skip to content

KEV: ConnectWise ScreenConnect path traversal (CVE-2024-1708)

Signal: Added to CISA KEV on 2026-04-28 (due 2026-05-12). Treat exploited ScreenConnect exposure as a high-priority remote-management incident risk.

What it is

ConnectWise ScreenConnect contains a path traversal vulnerability that can affect confidentiality and critical systems, with CISA tracking exploitation in the wild.

Because ScreenConnect is a remote-management platform, successful exploitation can quickly become an operator beachhead: remote access, credential access, tooling deployment, and lateral movement.

References: - CISA KEV entry: https://www.cisa.gov/known-exploited-vulnerabilities-catalog - Vendor bulletin: https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8 - NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-1708

Triage

  1. Inventory every ScreenConnect / ConnectWise Control instance:
  2. internet-facing servers
  3. MSP / contractor-managed deployments
  4. forgotten lab, trial, or failover hosts
  5. Identify version, patch state, and exposure path.
  6. Review identity integrations, admin users, and recent session activity.
  7. Check whether the server has access into privileged management networks.

Mitigation

  • Apply vendor mitigations or upgrade immediately.
  • If patch status is uncertain, remove public exposure first.
  • Restrict access with VPN, identity-aware proxy, or allowlisted admin networks.
  • Rotate local/admin credentials and API tokens if exploitation cannot be ruled out.

Hunt / detection

Look for: - unexpected ScreenConnect administrative users or role changes - unknown sessions, agents, or endpoint enrollment activity - file writes outside expected application paths - archive/tool drops, web shells, or remote execution artifacts - new scheduled tasks, services, startup items, or remote management tools

Correlate ScreenConnect logs with endpoint telemetry on managed hosts. A compromised remote-management server may leave stronger evidence on downstream endpoints than on the server itself.

Recovery notes

If exploitation is suspected: - preserve ScreenConnect application logs and host telemetry before cleanup - isolate the management server from client networks - rotate credentials used by integrations, service accounts, and technicians - validate every managed endpoint touched during the exposure window