CVE-2024-1709ConnectWise ScreenConnect auth bypass via an alternate path
What broke
ConnectWise ScreenConnect through 23.9.7 left an alternate SetupWizard path that did not require authentication (CWE-288). An unauthenticated caller finished setup again and created an administrator. Huntress reproduced it the day of disclosure (19 February 2024). CISA added it to KEV. CVSS 10.0. CVE-2024-1708 is the companion path traversal. Together they are RCE.
Why it matters
ScreenConnect is how MSPs and internal IT remote into everything. An auth bypass there is a meta-IdP, the same class as N-able N-central and PaperCut. Exploitation started immediately. "We will patch next change window" was the wrong sentence.
What to do
- Upgrade to ScreenConnect 23.9.8 or later. If the box was internet-facing on 19-21 February 2024, rebuild it.
- Hunt for admin users created through SetupWizard, unexpected extensions, and new remote sessions.
- Take the management UI off the internet. Put it behind phishing-resistant MFA and a jump path.
After you patch
Remote management and support platforms are standing administrative access to every endpoint beneath them, which turns a single bypass into a many-customer incident.
- Revoke sessions and rotate the platform's own credentials, including agent enrolment keys.
- Review remote session logs for connections you cannot attribute to a technician.
- Look for independent egress the attacker may have added, such as new tunnel services or remote access tools on managed endpoints, because removing them from the console does not remove them from the network.
- Treat the platform as tier-zero privileged access in your access model going forward, not as IT tooling.
Sources
- NVD: CVE-2024-1709
- CISA KEV
- Huntress, "A Catastrophe For Control," February 2024
Related identity CVEs
- CVE-2026-84869ScreenConnect client runs transferred files without host confirmation
- CVE-2026-18577N-able N-central auth bypass, incomplete patch of CVE-2026-18556
- CVE-2024-27198JetBrains TeamCity 2024 authentication bypass, admin access
- CVE-2023-27351PaperCut NG/MF improper authentication, still on CISA KEV
Related on Start with Identity
- CVEScreenConnect client runs transferred files without host confirmation
ScreenConnect clients before 26.6.5 could let files be pushed and run through an active session without authorization or host confirmation, including with eleva
- CVEJetBrains TeamCity 2024 authentication bypass, admin access
Unauthenticated attacker becomes a TeamCity administrator on on-prem instances. CVSS 9.8. Widely exploited. CISA KEV. The 2024 sequel to CVE-2023-42793, and the
- CVECheck Point VPN certificate validation flaw, from one-day to pre-auth RCE on the gateway
Check Point Security Gateway and Spark firewalls mishandled certificate data during VPN negotiation, giving unauthenticated code execution. Patched September 9,
- Blog39% of identity CVEs are on CISA KEV, and edge appliances hold 62% of the exploited ones
SWI's Identity Vulnerability Report 2026 checked 137 identity CVEs against CISA's Known Exploited Vulnerabilities catalog and NVD. 53 are exploited, most of the
- BlogCISA adds the last two Ivanti Connect Secure chain flaws to KEV after Ivanti's October 29 patch
CISA added Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527 to its exploited list on October 30, a day after Ivanti patched the root escalation UTA0576
- BlogIvanti Connect Secure auth bypass exploited; CISA gave agencies three days
CVE-2026-104935 lets an unauthenticated attacker bypass Ivanti Connect Secure's login with a crafted header and run commands. Exploited since early October by a