CISA Warns of ConnectWise ScreenConnect Vulnerability Exploited in Attacks

Key Takeaways

• The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning regarding active exploitation of a critical vulnerability in ConnectWise ScreenConnect.
• The flaw, identified as CVE-2024-1708, is a path traversal weakness that enables remote code execution and unauthorized access to sensitive systems.
• ConnectWise ScreenConnect, a widely used remote support tool, is particularly vulnerable due to its elevated system permissions.
• CISA has added CVE-2024-1708 to its Known Exploited Vulnerabilities (KEV) catalog, mandating a patch deadline for federal agencies by May 12, 2026, and strongly recommending the same for private sector organizations.

CISA Flags ConnectWise ScreenConnect Flaw as Actively Exploited

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical alert regarding a severe security vulnerability within ConnectWise ScreenConnect, a popular remote support solution. This flaw, cataloged as CVE-2024-1708, was officially added to CISA’s Known Exploited Vulnerabilities (KEV) catalog on April 28, 2026, confirming its active exploitation by malicious actors in real-world attacks.

The inclusion in the KEV catalog underscores the immediate threat posed by this vulnerability, indicating that cybercriminals are currently leveraging it to gain unauthorized access to networks and systems.

Understanding the ConnectWise ScreenConnect Vulnerability

ConnectWise ScreenConnect is a widely adopted remote desktop support application, essential for IT professionals to manage and troubleshoot computers from a distance. Its operational requirements necessitate high-level network permissions, making any security lapse a critical gateway for attackers seeking deep access into corporate infrastructure.

CVE-2024-1708 is specifically categorized as a path traversal vulnerability, referenced under CWE-22. This type of flaw arises when an application fails to adequately sanitize or filter file paths provided by an external user. Such an oversight allows an attacker to manipulate file path requests, enabling them to navigate beyond intended directories and access restricted areas of the server.

Exploitation of this path traversal weakness grants cybercriminals the ability to execute arbitrary code remotely. This can lead to a range of severe consequences, including the exfiltration of confidential data, alteration of critical system files, and ultimately, complete compromise of vital IT resources.

While CISA has confirmed active exploitation, the agency currently lists the direct association of CVE-2024-1708 with specific ransomware campaigns as “Unknown.” Nevertheless, remote access tools like ScreenConnect remain prime targets for ransomware groups and data extortion syndicates. Attackers frequently exploit vulnerabilities in these tools as an initial entry point into target networks, subsequently deploying ransomware payloads or selling network access to other criminal entities.

Given the confirmed active exploitation, security teams must treat this vulnerability with the utmost urgency and recognize it as an extreme risk to their network integrity.

What You Should Do

• Immediately apply all available security patches and mitigations released by ConnectWise for ScreenConnect.
• Adhere to CISA’s Binding Operational Directive (BOD) 22-01 concerning the secure management of cloud services, if applicable.
• If patching is not immediately feasible or mitigations are unavailable, consider isolating or temporarily discontinuing the use of ConnectWise ScreenConnect until the vulnerability can be addressed.
• Enhance monitoring of internal systems for any anomalous administrative activities, unexpected remote connections, or unauthorized attempts to access files.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.