On February 22, 2024, CISA added ConnectWise ScreenConnect vulnerability CVE-2024-1709 to its Known Exploited Vulnerabilities (KEV) catalog [1]. ConnectWise stated that cloud-hosted instances were mitigated first, while self-hosted servers must be updated to patched versions [2]. NVD rates this authentication bypass as critical; organizations using the software should update immediately and audit for unauthorized administrator accounts [3].
Backfill: this event became public on Feb 22, 2024 and we added it on Nov 8, 2026. It is not a new event.
CISA Adds ConnectWise ScreenConnect Authentication Bypass Vulnerability CVE-2024-1709 to Known Exploited Vulnerabilities Catalog
1 min read
- Disclosed
- Feb 22, 2024
- Published
- Nov 8, 2026
- Last updated
- Nov 7, 2026
- CVSS basis
- Our assessment
- 100%, higher than 100% of CVEs
- Exploitation and patch status
- ExploitedPatch available
- Attack vector
- Actor type
- Motivation
On this page
30-second summary
What happened
Who is affected
Organisations running: ConnectWise ScreenConnect
What to do nowOur advice
NVD rates this authentication bypass as critical; organizations using the software should update immediately and check for unauthorized administrator accounts [3].
Affected scope
Do you run this product?
Add it to your systems list and we'll email you about related advisories and major updates.
Timeline
Technical details
Source-Supported Details
On-premises instances should be updated to version 23.9.8 or the vendor-specified patched release, and administrators should audit for newly created admin accounts and anomalous remote sessions [1].
Source excerpt: "Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of Catalog vulnerabilities as part of their vulnerability management practice." [1].
Source excerpt: "On February 13, 2024, an independent researcher ethically and responsibly reported a potential critical ConnectWise ScreenConnect™ vulnerability using the ConnectWise vulnerability disclosure program through the ConnectWise Trust Center." [2].
References
Official / primary3
- [1]
“Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of Catalog vulnerabilities as part of their vulnerability management practice.”
- [2]
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.