CVE-2024-1709: ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alterna
Summary
ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel vulnerability, which may allow an attacker direct access to confidential information or critical systems.
Why It Matters
CRITICAL severity — known to be exploited in the wild（CISA KEV）；action required: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. .
Current Status
- Vulnerability status: Known exploited (CISA KEV)
- Last intelligence update: 2026-06-17 · source: NVD
- CISA KEV added: 2024-02-22 · remediation deadline: 2024-02-29
Entity Activity Timeline
- 2024-02-22 — Added to CISA KEV as known-exploited · action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- 2024-02-21 — NVD publication / disclosure
- 2026-06-17 — Intelligence record updated（NVD sync）
Severity
CRITICAL
CVSS Score: 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Known Exploited (CISA KEV)
Known Exploited Vulnerability
Added: 2024-02-22 · Remediation deadline: 2024-02-29
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Source Attribution
Source: NVD · Updated: 2026-06-17T07:04:50.557 · Confidence: high
Impact
Based on CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — assess confidentiality, integrity, and availability impact via the official vector documentation.
Affected Software
Fix
Upgrade affected software to the fixed version identified above. Apply vendor patches and monitor advisories before exposed systems go unpatched.
Sources & Evidence
- https://github.com/rapid7/metasploit-framework/pull/18870
- https://github.com/watchtowrlabs/connectwise-screenconnect_auth-bypass-add-user-poc
- https://techcrunch.com/2024/02/21/researchers-warn-high-risk-connectwise-flaw-under-attack-is-embarrassingly-easy-to-exploit/
- https://www.bleepingcomputer.com/news/security/connectwise-urges-screenconnect-admins-to-patch-critical-rce-flaw/
- https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
- https://www.horizon3.ai/attack-research/red-team/connectwise-screenconnect-auth-bypass-deep-dive/
- https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
- https://www.huntress.com/blog/detection-guidance-for-connectwise-cwe-288-2
- https://www.huntress.com/blog/vulnerability-reproduced-immediately-patch-screenconnect-23-9-8
- https://www.securityweek.com/connectwise-confirms-screenconnect-flaw-under-active-exploitation/
- https://github.com/rapid7/metasploit-framework/pull/18870
- https://github.com/watchtowrlabs/connectwise-screenconnect_auth-bypass-add-user-poc
- https://techcrunch.com/2024/02/21/researchers-warn-high-risk-connectwise-flaw-under-attack-is-embarrassingly-easy-to-exploit/
- https://www.bleepingcomputer.com/news/security/connectwise-urges-screenconnect-admins-to-patch-critical-rce-flaw/
- https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
- https://www.horizon3.ai/attack-research/red-team/connectwise-screenconnect-auth-bypass-deep-dive/
- https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
- https://www.huntress.com/blog/detection-guidance-for-connectwise-cwe-288-2
- https://www.huntress.com/blog/vulnerability-reproduced-immediately-patch-screenconnect-23-9-8
- https://www.securityweek.com/connectwise-confirms-screenconnect-flaw-under-active-exploitation/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-1709
Export threat intelligence
Download an OASIS STIX 2.1 threat-intelligence bundle (JSON) for MISP / OpenCTI / TAXII import
Start Investigation
Move from reading to investigating CVE-2024-1709: ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alterna. The workspace is a structured analysis surface — not a chat — organised as:
- Question — what do you need to know about CVE-2024-1709: ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alterna?
- Evidence — assertions mapped to verifiable references.
- Timeline — events in chronological order.
- Related Entities — CVE, threat actor, campaign, malware links.
- Sources — NVD, CISA KEV, MITRE ATT&CK, vendor advisories.
- Notes — your own observations and working hypotheses.
AI assistance is limited to summarising, explaining, and suggesting related evidence. AI never completes your investigation, modifies entity relationships, or generates facts — all published analysis stays human-reviewed.
Recommended Tools
- CVE Lookup Open the full CVE record — severity, CVSS, affected products, CISA KEV and references. Open CVE record
Every tool runs passively or locally — inputs are never stored and no target is scanned. Start an investigation on this entity →