DaystoPatch

ConnectWiseExploited incident

ConnectWise ScreenConnect authentication bypass and path traversal (ScreenConnect 23.9.8 security fix)

CVE-2024-1709, CVE-2024-1708Critical, CVSS 10.0In CISA's Known Exploited Vulnerabilities catalog since 22 Feb 2024

  • Exploited after a fix existed
  • Known ransomware use
FixedFixed for every supported version 4 days after the first public report.

Response

Silence
same day
First public report to first vendor statement
Exposure
same day
First public report to first fix
Follow-through
4d
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    date only

    ConnectWise security bulletin: ScreenConnect 23.9.8 security fix (02/19/2024)CuratedQuote verified

    Vulnerabilities were reported February 13, 2024, through our vulnerability disclosure channel via the ConnectWise Trust Center. There is no evidence that these vulnerabilities have been exploited in the wild

    Coordinated disclosure: the bulletin dated 02/19/2024 was the first public signal and shipped with the fix; exploitation followed (see the 2024-02-20 candidate).

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:75128a7e7d50302b…
    Used in metrics
    Yes
    Dispute this timestamp
    7 more sources for this moment
    ConnectWise security bulletin, 'February 20, 2024 update'CuratedQuote verified20 Feb 2024

    We've received notifications of suspicious activity that our incident response team has investigated. The following IP addresses were used by threat actors.

    First vendor acknowledgement of in-the-wild activity, one day after the fix, under the heading 'February 20, 2024 update:'.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:75128a7e7d50302b…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2024-1708ClaimedQuote verified21 Feb 2024, 15:29 UTC

    ConnectWise ScreenConnect 23.9.7 and prior are affected by path-traversal vulnerability, which may allow an attacker

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:8f65d4bbe486ae84…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Hacker NewsClaimedQuote not checked yet21 Feb 2024, 20:40 UTC

    ScreenConnect Authentication Bypass (CVE-2024-1709 and CVE-2024-1708)

    Earliest third-party post we hold. An independent author on another platform posted within 48 hours. Used for unreviewed incidents only, never graded.

    Source
    Hacker News hn
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2024-1709)ClaimedQuote verified22 Feb 2024

    ConnectWise ScreenConnect Authentication Bypass Vulnerability

    Added to CISA's KEV catalog on 2024-02-22.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet22 Feb 2024, 19:23 UTC

    We've improved the scanning/detection for vulnerable instances of ConnectWise ScreenConnect (CVE-2024-1709/CVE-2024-1708) - we now see over 8200 vulnerable instances (on 2024-02-21).

    Earliest third-party post we hold. An independent author on another platform posted within 48 hours. Used for unreviewed incidents only, never graded.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2024-1708)ClaimedQuote verified28 Apr 2026

    ConnectWise ScreenConnect Path Traversal Vulnerability

    Added to CISA's KEV catalog on 2026-04-28.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet29 Apr 2026, 09:34 UTC

    CISA Flags Actively Exploited ConnectWise, Windows Flaws The US Cybersecurity and Infrastructure Security Agency (CISA) has flagged two major vulnerabilities, including a critical flaw in

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    date onlysame day

    ConnectWise security bulletin: ScreenConnect 23.9.8 security fix (02/19/2024)CuratedQuote verified

    02/19/2024

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:75128a7e7d50302b…
    Used in metrics
    Yes
    Dispute this timestamp

  3. First workaround

    No official mitigation found yet.

  4. First fix

    date onlysame day

    ConnectWise security bulletin: ScreenConnect 23.9.8 security fix (02/19/2024)CuratedQuote verified

    Partners that are self-hosted or on-premise need to update their servers to version 23.9.8 immediately to apply a patch.

    Original bulletin text (02/19/2024). Cloud instances ('screenconnect.com' and 'hostedrmm.com') had already been updated.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:75128a7e7d50302b…
    Used in metrics
    Yes
    Dispute this timestamp

  5. Fixed for all versions

    date only+4d

    ConnectWise security bulletin, 'February 23, 2024 update'CuratedQuote verified

    at no additional cost, which will fix CVE-2024-1709, the critical vulnerability. However, this should be treated as an interim step.

    Under the heading 'February 23, 2024 update:'. The original bulletin promised 'updated versions of releases 22.4 through 23.9.7 for the critical issue'; the 22.4 patch (22.4.20001 per the 2024-02-27 update) was offered to partners off maintenance. It is described as fixing CVE-2024-1709 only; we found no statement that older-release patches also fix CVE-2024-1708, which is fixed in 23.9.8.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:75128a7e7d50302b…
    Used in metrics
    Yes
    Dispute this timestamp

Send this to your boss

No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.

Affected products

  • ConnectWise ScreenConnect (on-premises) 23.9.7 and prior
How we built this timeline

In scope because CVE-2024-1708 was added to KEV on 28 Apr 2026 (ransomware use: Known); grouped with CVE-2024-1709 because both were fixed in the same bulletin (ScreenConnect 23.9.8) and were exploited together in 2024. CVE-2024-1709 was added to KEV on 22 Feb 2024 (ransomware: Known), so kev_added is the earliest date.

The bulletin identifies the bugs by CWE (CWE-288, base score 10; CWE-22, base score 8.4); the CVE IDs appear in its later updates.

Primary CVE is CVE-2024-1709 (listed first, highest score). On 22 Feb 2024 ConnectWise also began suspending unpatched on-premises instances not on 23.9.8 or later.

The bulletin page accumulates dated updates above the 'Original Bulletin' section; all quotes come from the current page.

Related

No related incidents.

ConnectWise report card