CVE-2024-1709: ConnectWise ScreenConnect authentication bypass, mass-exploited
The short version: ConnectWise ScreenConnect has an authentication-bypass flaw (CVE-2024-1709) that lets an unauthenticated attacker reach the initial-setup wizard on an already-configured server and create a new administrator. Chained with a path-traversal bug (CVE-2024-1708), that means full takeover of a remote-access tool. It scores a perfect 10.0, it was mass-exploited within days of disclosure — including by ransomware crews — and it's in CISA's KEV catalog. If you self-host ScreenConnect, this is patch-and-verify. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | Moderate — in practice and on paper |
| CVSS v3.1 (NVD) | 10.0 — Critical · AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| EPSS | 99.96% · 99.98th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2024-02-29 |
| Known exploited? | Yes — mass exploitation, including ransomware operators |
| Vulnerability type | CWE-288 authentication bypass using an alternate path → administrator creation |
| Requires authenticated session? | No — pre-authentication |
| Chained with | CVE-2024-1708 (path traversal) for code execution after takeover |
| Affected | ScreenConnect 23.9.7 and all prior versions |
| Fixed in | ScreenConnect 23.9.8 |
What you need to know
ScreenConnect's setup wizard is meant to run once, when a server is first stood up. The bug lets an unauthenticated attacker reach that wizard on a fully configured server through an alternate path, and use it to create a brand-new administrator account.
This is about as bad as external exposure gets, and the target makes it worse:
- It's a remote-access platform. Admin on ScreenConnect means the ability to push commands and software to every endpoint it manages — a direct route to fleet-wide compromise.
- It's pre-authentication and trivially reachable. ScreenConnect servers are meant to be internet-facing so technicians can connect; no credential, no chain needed to get admin.
- It was chained for full RCE. Paired with CVE-2024-1708 (path traversal), attackers moved from admin creation to code execution, and it saw immediate mass exploitation — including ransomware — which is why EPSS is essentially maxed.
How serious we see it
Moderate — the 10.0 is earned.
Unauthenticated administrator creation on an internet-facing remote-management server, confirmed mass-exploited, is the definition of top-of-queue. The bounded, reassuring part is that it's specific and fixed: it affects self-hosted ScreenConnect at or below 23.9.7, ConnectWise shipped 23.9.8, and exposure is quick to determine. The catch is the usual one — given how fast this was exploited, patched and clean are separate questions.
Recommendations
Straight from ConnectWise's advisory and CISA:
- Patch now. Upgrade self-hosted ScreenConnect to 23.9.8 or later. (ConnectWise-hosted cloud instances were remediated centrally.)
- Hunt for abuse. Check for newly created administrator accounts, unexpected extensions, and anomalous session activity.
- If compromised, respond fully. Remove rogue accounts, investigate managed endpoints for pushed payloads, and rotate credentials and secrets.
- Harden exposure. Limit who can reach the ScreenConnect server, and keep it on supported, patched builds.
- Confirm your exposure first. Verify whether you run a self-hosted ScreenConnect and which version.
How BreachRisk sees it
BreachRisk answers the first question — do we have an exposed, affected ScreenConnect? — from the outside in. Starting from little more than your domain, it discovers internet-facing ScreenConnect servers, fingerprints the version, and flags exposure tied to KEV-listed, actively exploited vulnerabilities like this one, surfaced at the top because it's in KEV. We identify and flag the affected version; we don't create accounts or exploit it. When an RMM zero-day breaks, the exposed server is already mapped, so you go straight to patch-and-verify.