Vulnerabilities/ConnectWise/CVE-2024-1709
CVE-2024-1709: ConnectWise ScreenConnect Authentication Bypass Vulnerability
CISA KEV entry · Last checked 30 Oct 2026, 12:10 UTC
Exploitation confirmedRansomware use knownPatch available
CVSS 3.1 · NVD10.0Critical
EPSS100.0%100th percentile · 29 Oct 2026
CISA KEVListedAdded 22 Feb 2024
ConnectWise ScreenConnect contains an authentication bypass vulnerability that allows an attacker with network access to the management interface to create a new, administrator-level account on affected devices.
Recommended action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA due date 29 Feb 2024 · CWE-288
Am I affected?
| Product | Affected versions | Fixed in |
|---|---|---|
| ScreenConnect | up to 23.9.7; unaffected from 23.9.8 | 23.9.8 |
| screenconnect | up to 23.9.7 | Unknown |
Before you patch
Restart
See vendor guidance.Known issues
Check release notes.Verification
Confirm installed version.Timeline
- 22 Feb 2024 · Added to CISA KEV
- 29 Feb 2024 · CISA due date
Sources checked
| CISA KEV | 30 Oct 2026, 12:10 UTC |
| CVE List v5 | 30 Oct 2026, 12:10 UTC |
| NVD | 30 Oct 2026, 12:10 UTC |
| FIRST EPSS | 30 Oct 2026, 12:11 UTC |
Data from CISA, MITRE, NVD and FIRST. Sources and licences.