---
id: "CVE-2024-1708"
kind: "vulnerability"
aliases: ["CVE-2024-1708"]
title: "ConnectWise ScreenConnect 23.9.7 and prior are affected by path-traversal vulnerability, which may allow an attacker\u2026"
severity: "critical"
cvss: 8.4
epss: null
exploited: true
status: "open"
category: "other"
products: [{"name": "connectwise screenconnect", "fixed": ["23.9.8"], "affected": "< 23.9.8", "ecosystem": "vendor"}, {"name": "ConnectWise ScreenConnect", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["connectwise", "exploited", "other", "ransomware", "remote-access", "screenconnect", "self-hosted"]
not_affected_if: ["managed-hosting"]
published_at: "2024-02-21T16:15:50+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-24T00:09:50+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-1708", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1708", "first_seen_at": "2026-10-23T23:44:51+00:00"}]
---

# ConnectWise ScreenConnect 23.9.7 and prior are affected by path-traversal vulnerability, which may allow an attacker…

ConnectWise ScreenConnect has a path traversal flaw that lets an attacker reach files outside the intended directory. The advisory says this can lead to remote code execution or access to confidential data, and CISA lists it as actively exploited with ransomware use.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:connectwise screenconnect affected < 23.9.8 fixed 23.9.8
- vendor:ConnectWise ScreenConnect affected ? fixed ?

## Fix

Apply the mitigations and update per the ConnectWise vendor instructions; if mitigations are unavailable, CISA says to discontinue use of the product.
Affected and fixed versions: unknown from these sources.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-1708
- 2026-10-23T23:44:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2024-1708

## From the sources

ConnectWise ScreenConnect contains a path traversal vulnerability which could allow an attacker to execute remote code or directly impact confidential data and critical systems.

CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_