CVE-2024-1709
CRITICALVulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V14 - Configuration Dependency management, component inventory
|
| Impact | Maximum risk (CVSS 10.0, EPSS 94.3%). ScreenConnect is a remote management and monitoring (RMM) tool managing thousands of endpoints per server. Compromising a ScreenConnect server gives immediate access to ALL managed endpoints. Exploitation began within hours of PoC release. |
| Exploit ScenarioDerived | An attacker accesses the ScreenConnect setup page on an internet-facing server, creates a new admin account, and gains control of the ScreenConnect console. They then use the legitimate remote management features to deploy ransomware to all connected client endpoints simultaneously. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 26, 2026
ConnectWise ScreenConnect contains a critical authentication bypass (CVSS 10.0) that allows direct access to the administrative interface, mass-exploited within hours of disclosure for ransomware deployment.
Earlier versions of this analysis (1)
A critical authentication bypass in ConnectWise ScreenConnect allows unauthenticated attackers to directly access the administrative setup wizard and gain full control of the ScreenConnect server, including all managed endpoints.
RemediationAI
Update ScreenConnect immediately to 23.9.8+. ConnectWise cloud-hosted instances were auto-patched. On-premise instances require manual update. Audit for unauthorized admin accounts. Check all managed endpoints for compromise.
Affected ProductsAI
ConnectWise ScreenConnect 23.9.7 and prior
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The CWE-288 authentication bypass allows attackers to access the initial setup wizard even after ScreenConnect has been configured. This provides the ability to create new administrator accounts, modify server configuration, and execute code on all connected endpoints.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel
vulnerability, which may allow an attacker direct access to confidential information or
critical systems.
Executive ViewAI
CVE-2024-1709 presents critical security risk rated CVSS 10.0. Successful exploitation could critically impact the confidentiality, integrity, and availability of affected systems. This vulnerability is actively exploited in the wild (KEV-listed) and requires immediate remediation. A patch is available and should be applied immediately given the critical severity.
Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB