CVE-2024-1709: ConnectWise ScreenConnect auth bypass

CVE-2024-1709 is an authentication-bypass vulnerability in ConnectWise ScreenConnect that lets an unauthenticated remote attacker create a new administrator-level account on an already-set-up instance, effectively taking it over, and it was exploited in the wild within days of disclosure, including in ransomware intrusions.

CVE-2024-1709 is an authentication bypass using an alternate path or channel (CWE-288) in ConnectWise ScreenConnect. On an instance that has already completed initial setup, an unauthenticated attacker can still reach the setup-wizard code path and use it to create a new account with administrator privileges, giving direct access to the ScreenConnect server and, through it, the remote-access sessions and machines it manages (NVD).

NVD's own analysis and the CNA-submitted score agree: CVSS v3.1 10.0 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — network-reachable, low attack complexity, no privileges or user interaction required, scope change, and high impact to confidentiality, integrity and availability — the maximum possible base score (NVD).

ConnectWise's own security bulletin states the flaw affects ScreenConnect 23.9.7 and earlier, is fixed in 23.9.8, and that cloud-hosted partners were patched automatically while on-premise partners had to upgrade manually (following a documented upgrade chain for older releases). The bulletin, as first published, stated there was "no evidence that these vulnerabilities have been exploited in the wild" at disclosure time (ConnectWise Security Bulletin: ScreenConnect 23.9.8).

That changed within days: CISA added CVE-2024-1709 to the Known Exploited Vulnerabilities (KEV) catalog on 2024-02-22, with a required-action due date of 2024-02-29, and the catalog records known use in ransomware campaigns (CISA KEV).

As of 2026-10-20, FIRST scores the probability of exploitation at 0.9998 (99.981th percentile), consistent with a flaw that was trivially exploitable and rapidly weaponized (FIRST EPSS).

Any on-premise ScreenConnect instance still below 23.9.8 should be upgraded immediately and reviewed for unexpected administrator accounts or sessions created around the disclosure window, given the documented ransomware use.

• Authentication bypass using an alternate path or channel in ScreenConnect allows an unauthenticated attacker to create an administrator-level account on an already-configured instance. — NVD
• CVSS v3.1 base score is 10.0 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, agreed by both NVD and the submitting CNA. — NVD
• Affected ScreenConnect through 23.9.7, fixed in 23.9.8; cloud partners patched automatically, on-premise partners required a manual upgrade; bulletin as first published stated no evidence of in-the-wild exploitation. — ConnectWise Security Bulletin
• Added to the CISA Known Exploited Vulnerabilities catalog on 2024-02-22, due date 2024-02-29, with known ransomware campaign use. — CISA KEV
• EPSS score is 0.9998 (99.981th percentile) as of 2026-10-20. — FIRST EPSS