Critical severity10.0CISA KEVNVD Advisory· Published Feb 21, 2024· Updated Jun 17, 2026
CVE-2024-1709
CVE-2024-1709
Description
ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel
vulnerability, which may allow an attacker direct access to confidential information or
critical systems.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3<=23.9.7+ 2 more
- (no CPE)range: <=23.9.7
- cpe:2.3:a:connectwise:screenconnect:*:*:*:*:*:*:*:*range: <23.9.8
- (no CPE)range: 0
Patches
Vulnerability mechanics
References
10- github.com/rapid7/metasploit-framework/pull/18870nvdIssue TrackingPatchThird Party Advisory
- www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypassnvdExploitThird Party Advisory
- www.huntress.com/blog/detection-guidance-for-connectwise-cwe-288-2nvdExploitThird Party Advisory
- techcrunch.com/2024/02/21/researchers-warn-high-risk-connectwise-flaw-under-attack-is-embarrassingly-easy-to-exploit/nvdPress/Media CoverageThird Party Advisory
- www.bleepingcomputer.com/news/security/connectwise-urges-screenconnect-admins-to-patch-critical-rce-flaw/nvdPress/Media CoverageThird Party Advisory
- www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8nvdVendor Advisory
- www.horizon3.ai/attack-research/red-team/connectwise-screenconnect-auth-bypass-deep-dive/nvdThird Party Advisory
- www.huntress.com/blog/vulnerability-reproduced-immediately-patch-screenconnect-23-9-8nvdThird Party Advisory
- www.securityweek.com/connectwise-confirms-screenconnect-flaw-under-active-exploitation/nvdPress/Media CoverageThird Party Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalognvdUS Government Resource
News mentions
5- Weekly Cyber Security Newsletter Bulletin – Entra ID RCE, Claude Code Ransomware, T-Mobile Cable, Azure Credential Theft +20 StoriesCyber Security News · Aug 23, 2026
- CISA Warns Medusa Ransomware Hackers Steal Data, Kill Security Tools, and Encrypt Entire NetworksCyber Security News · Aug 18, 2026
- China-Linked Hackers Deploy New StormEncryptor Ransomware, Likely via N-central FlawThe Hacker News · Aug 10, 2026
- Inside the customer environment: Where threat actors, vulnerabilities, and exposed assets intersectTenable Blog · May 27, 2026
- CISA Adds Actively Exploited ConnectWise and Windows Flaws to KEVThe Hacker News · Apr 29, 2026