{"id":"CVE-2024-1709","published":"2024-02-21T16:15:50Z","modified":"2026-06-17T07:04:50Z","title":"ConnectWise ScreenConnect Authentication Bypass Vulnerability","vendor":"ConnectWise","product":"ScreenConnect","tier":"core","eol":null,"description":{"text":"ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel\n\n vulnerability, which may allow an attacker direct access to confidential information or \n\ncritical systems.","provenance":"source","from":"NVD"},"summary":{"text":"ConnectWise ScreenConnect contains an authentication bypass flaw, classified as using an alternate path or channel, affecting ScreenConnect 23.9.7 and earlier. An attacker who can reach the service over the network, without needing credentials or any user interaction, may be able to gain direct access to confidential information or critical systems.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T06:54:53Z"},"cvss":{"score":10.0,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.9998,"percentile":0.9998,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2024-02-22","dueDate":"2024-02-29","ransomware":true,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8; https://nvd.nist.gov/vuln/detail/CVE-2024-1709","provenance":"source"},"vulncheckKev":{"dateAdded":"2024-02-20","exploitedFirstSeen":"2024-02-20","ransomware":true,"evidence":[{"url":"https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8","date":"2024-02-20"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-02-21&host_type=src&vulnerability=cve-2024-1709","date":"2024-02-21"},{"url":"https://unit42.paloaltonetworks.com/connectwise-threat-brief-cve-2024-1708-cve-2024-1709/","date":"2024-02-21"},{"url":"https://www.rapid7.com/blog/post/2024/02/20/etr-high-risk-vulnerabilities-in-connectwise-screenconnect/","date":"2024-02-21"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-02-22&host_type=src&vulnerability=cve-2024-1709","date":"2024-02-22"},{"url":"https://infosec.exchange/@SophosXOps/111975043941611370","date":"2024-02-22"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2024-02-22"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-02-23&host_type=src&vulnerability=cve-2024-1709","date":"2024-02-23"},{"url":"https://news.sophos.com/en-us/2024/02/23/connectwise-screenconnect-attacks-deliver-malware/","date":"2024-02-23"},{"url":"https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708","date":"2024-02-23"}],"evidenceTotal":772,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-288","name":"Authentication Bypass Using an Alternate Path or Channel"}],"references":[{"url":"https://github.com/rapid7/metasploit-framework/pull/18870","tags":["Issue Tracking","Patch","Third Party Advisory"]},{"url":"https://github.com/watchtowrlabs/connectwise-screenconnect_auth-bypass-add-user-poc","tags":["Exploit","Third Party Advisory"]},{"url":"https://techcrunch.com/2024/02/21/researchers-warn-high-risk-connectwise-flaw-under-attack-is-embarrassingly-easy-to-exploit/","tags":["Press/Media Coverage","Third Party Advisory"]},{"url":"https://www.bleepingcomputer.com/news/security/connectwise-urges-screenconnect-admins-to-patch-critical-rce-flaw/","tags":["Press/Media Coverage","Third Party Advisory"]},{"url":"https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8","tags":["Vendor Advisory"]},{"url":"https://www.horizon3.ai/attack-research/red-team/connectwise-screenconnect-auth-bypass-deep-dive/","tags":["Third Party Advisory"]},{"url":"https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.huntress.com/blog/detection-guidance-for-connectwise-cwe-288-2","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.huntress.com/blog/vulnerability-reproduced-immediately-patch-screenconnect-23-9-8","tags":["Third Party Advisory"]},{"url":"https://www.securityweek.com/connectwise-confirms-screenconnect-flaw-under-active-exploitation/","tags":["Press/Media Coverage","Third Party Advisory"]},{"url":"https://github.com/rapid7/metasploit-framework/pull/18870","tags":["Issue Tracking","Patch","Third Party Advisory"]},{"url":"https://github.com/watchtowrlabs/connectwise-screenconnect_auth-bypass-add-user-poc","tags":["Exploit","Third Party Advisory"]},{"url":"https://techcrunch.com/2024/02/21/researchers-warn-high-risk-connectwise-flaw-under-attack-is-embarrassingly-easy-to-exploit/","tags":["Press/Media Coverage","Third Party Advisory"]},{"url":"https://www.bleepingcomputer.com/news/security/connectwise-urges-screenconnect-admins-to-patch-critical-rce-flaw/","tags":["Press/Media Coverage","Third Party Advisory"]},{"url":"https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8","tags":["Vendor Advisory"]},{"url":"https://www.horizon3.ai/attack-research/red-team/connectwise-screenconnect-auth-bypass-deep-dive/","tags":["Third Party Advisory"]},{"url":"https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.huntress.com/blog/detection-guidance-for-connectwise-cwe-288-2","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.huntress.com/blog/vulnerability-reproduced-immediately-patch-screenconnect-23-9-8","tags":["Third Party Advisory"]},{"url":"https://www.securityweek.com/connectwise-confirms-screenconnect-flaw-under-active-exploitation/","tags":["Press/Media Coverage","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-1709","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping","report-attack-id"],"basisDetail":"claude-haiku-5-5: Authentication bypass via exposed public-facing application; ATT&CK ID T1190 introduces a list containing CVE-2024-1709","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"Authentication Bypass Using an Alternate Path or Channel","start":62,"end":118},{"reportId":"SRC-733f5480456da2725571","quote":"Exploitation of unpatched software vulnerabilities [T1190] through Common Vulnerabilities and Exposures (CVEs) such as:\r\n\r\nScreenConnect vulnerability CVE-2024-1709 [CWE-288: Authentication Bypass Using an Alternate Path or Channel].","start":4629,"end":4862}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1078","name":"Valid Accounts","tactics":["initial-access","persistence","privilege-escalation","stealth"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Bypass grants direct access, equivalent to valid accounts","mappingType":"primary_impact","evidence":[{"from":"description","quote":"may allow an attacker direct access to confidential information","start":142,"end":205}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-733f5480456da2725571","title":"#StopRansomware: Medusa Ransomware","publisher":"cisa.gov","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a","date":null,"mentions":[{"quote":"ScreenConnect vulnerability CVE-2024-1709 [CWE-288: Authentication Bypass Using an Alternate Path or Channel].","start":4752,"end":4862},{"quote":"ScreenConnect vulnerability CVE-2024-1709 [CWE-288: Authentication Bypass Using an Alternate Path or Channel].","start":5165,"end":5275}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-17443","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-17443","exploited":true,"exploitedSince":"2024-02-22","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":5,"skipped":0,"earliest":"2024-02-21","earliestUrl":"https://github.com/W01fh4cker/ScreenConnect-AuthBypass-RCE","repos":[{"name":"W01fh4cker/ScreenConnect-AuthBypass-RCE","url":"https://github.com/W01fh4cker/ScreenConnect-AuthBypass-RCE","stars":113,"created":"2024-02-21"},{"name":"HussainFathy/CVE-2024-1709","url":"https://github.com/HussainFathy/CVE-2024-1709","stars":3,"created":"2024-02-23"},{"name":"sxyrxyy/CVE-2024-1709-ConnectWise-ScreenConnect-Authentication-Bypass","url":"https://github.com/sxyrxyy/CVE-2024-1709-ConnectWise-ScreenConnect-Authentication-Bypass","stars":1,"created":"2024-03-22"},{"name":"cjybao/CVE-2024-1709-and-CVE-2024-1708","url":"https://github.com/cjybao/CVE-2024-1709-and-CVE-2024-1708","stars":1,"created":"2024-04-02"},{"name":"AhmedMansour93/Event-ID-229-Rule-Name-SOC262-CVE-2024-1709-","url":"https://github.com/AhmedMansour93/Event-ID-229-Rule-Name-SOC262-CVE-2024-1709-","stars":0,"created":"2024-09-12"}]},"metasploit":[{"name":"ConnectWise ScreenConnect Unauthenticated Remote Code Execution","module":"exploit/multi/http/connectwise_screenconnect_rce_cve_2024_1709","type":"exploit","disclosureDate":"2024-02-19","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/connectwise_screenconnect_rce_cve_2024_1709.rb"}],"nuclei":[{"id":"CVE-2024-1709","name":"ConnectWise ScreenConnect 23.9.7 - Authentication Bypass","severity":"critical","path":"http/cves/2024/CVE-2024-1709.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-1709.yaml"}],"first":{"date":"2024-02-19","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/connectwise_screenconnect_rce_cve_2024_1709.rb"},"provenance":"source"},"detections":{"cveRules":[{"title":"CVE-2024-1709 - ScreenConnect Authentication Bypass Exploitation","id":"d27eabad-9068-401a-b0d6-9eac744d6e67","level":"critical","status":"test","path":"rules-emerging-threats/2024/Exploits/CVE-2024-1709/web_exploit_cve_2024_1709_screenconnect.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Exploits/CVE-2024-1709/web_exploit_cve_2024_1709_screenconnect.yml","techniques":[]},{"title":"ScreenConnect User Database Modification","id":"1a821580-588b-4323-9422-660f7e131020","level":"medium","status":"test","path":"rules-emerging-threats/2024/Exploits/CVE-2024-1709/file_event_win_exploit_cve_2024_1709_user_database_modification_screenconnect.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Exploits/CVE-2024-1709/file_event_win_exploit_cve_2024_1709_user_database_modification_screenconnect.yml","techniques":[]},{"title":"ScreenConnect User Database Modification - Security","id":"4109cb6a-a4af-438a-9f0c-056abba41c6f","level":"medium","status":"test","path":"rules-emerging-threats/2024/Exploits/CVE-2024-1709/win_security_exploit_cve_2024_1709_user_database_modification_screenconnect.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Exploits/CVE-2024-1709/win_security_exploit_cve_2024_1709_user_database_modification_screenconnect.yml","techniques":[]}]},"exploitRefs":["https://github.com/watchtowrlabs/connectwise-screenconnect_auth-bypass-add-user-poc","https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass","https://www.huntress.com/blog/detection-guidance-for-connectwise-cwe-288-2"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1078"],"provenance":"ai"}],"timeline":[{"date":"2024-02-19","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2024-02-21","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/connectwise_screenconnect_rce_cve_2024_1709.rb","provenance":"source"},{"date":"2024-02-20","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8","provenance":"source"},{"date":"2024-02-21","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-1709","provenance":"source"},{"date":"2024-02-22","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2024-02-22","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-17443","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":1},"priority":{"score":83.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 984 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":20.0,"detail":"percentile 0.9998"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"3 NVD references tagged Exploit; 5 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":7.0,"detail":"base score 10.0"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}