# CVE-2024-1708: ConnectWise ScreenConnect path traversal

Source: https://junglewise.ai/threats/cve-2024-1708-connectwise-screenconnect-path-traversal  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-28. Updated: 2026-05-15  
License: CC BY 4.0 with a link back

CVE-2024-1708 · Severity: critical · CVSS 8.4 · Exploited in the wild · Published 2026-04-28

ConnectWise ScreenConnect, a remote desktop and support software, contains a security flaw that allows unauthorized access to restricted files. An attacker could exploit this to take control of the server, potentially leading to the theft of sensitive customer data or a total service outage. This vulnerability has been actively used in ransomware attacks to compromise corporate networks.

Technologies: [ConnectWise ScreenConnect](https://junglewise.ai/threats/technologies/screenconnect), [Microsoft Windows](https://junglewise.ai/threats/technologies/windows). Vendors: [ConnectWise](https://junglewise.ai/threats/vendors/connectwise), [Microsoft](https://junglewise.ai/threats/vendors/microsoft).

## Quick answers

**Is CVE-2024-1708 exploited in the wild?** Yes. CVE-2024-1708 is known to be exploited in the wild, first recorded on 28 April 2026. Treat it as urgent.

**How severe is CVE-2024-1708?** Critical severity, with a CVSS score of 8.4, published 28 April 2026.

**Which products and versions are affected?** ConnectWise ScreenConnect 23.9.7 and prior.

**Is there a fix for CVE-2024-1708?** A patch was published on 2024-02-21: Fixed in version 23.9.8 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-1708 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2024-1708?** Check whether you run ConnectWise ScreenConnect or Microsoft Windows at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability (CWE-22) exists in ConnectWise ScreenConnect versions 23.9.7 and prior. The flaw allows an attacker with high privileges to bypass directory restrictions, potentially leading to remote code execution (RCE) or unauthorized access to sensitive system files. While the CVSS vector indicates high privileges and user interaction are required, the vulnerability has been observed in the wild being used in conjunction with other flaws to facilitate ransomware operations. A fix is available in version 23.9.8.

## Affected products

- ConnectWise ScreenConnect 23.9.7 and prior

## Identifiers

- CVE-2024-1708
- CVE-2026-32202

## Timeline

- 2024-02-21: disclosed
- 2024-02-21: advisory: Vendor security bulletin released
- 2024-02-21: patched: Fixed in version 23.9.8
- 2026-04-28: kev added: Added to CISA KEV catalog due to active exploitation

## Related threats

- [Windows BitLocker heap buffer overflow with physical attack](https://junglewise.ai/threats/cve-2026-97015-heap-based-buffer-overflow-in-windows-bitlocker-allows-an)
- [Microsoft Windows Shell type confusion privilege elevation](https://junglewise.ai/threats/cve-2026-97013-access-of-resource-using-incompatible-type-type-confusion-in)
- [Microsoft Windows VMSwitch out-of-bounds read privilege escalation](https://junglewise.ai/threats/cve-2026-97002-out-of-bounds-read-in-windows-vmswitch-allows-an-authorized)
- [Microsoft Windows USM Communication Manager null pointer dereference](https://junglewise.ai/threats/cve-2026-97000-null-pointer-dereference-in-windows-usm-communication-manager)
- [Microsoft Windows Winsock use after free privilege escalation](https://junglewise.ai/threats/cve-2026-96994-use-after-free-in-winsock-allows-an-authorized-attacker-to)