Authentication bypass using an alternate path or channel

cisa required action Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

1. 2024-02-19 First public exploit (Metasploit exploit/multi/http/connectwise_screenconnect_rce_cve_2024_1709)
2. 2024-02-21 Published
3. 2024-02-22 Added to CISA KEV
4. 2024-02-24 CISA SSVC: exploitation active
5. 2024-02-29 CISA patch deadline

Added

2 y ago (2024-02-22)

Patch by

2024-02-29 (2 y ago)

Ransomware

Known to be used in ransomware campaigns

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Vendor, product

ConnectWise, ScreenConnect

CISA name

ConnectWise ScreenConnect Authentication Bypass Vulnerability

Groups reported to have exploited it in intrusions.

• BlackBasta ransomware gang
• Cicada3301 ransomware gang
• Bl00dy ransomware gang
• BlackCat ransomware gang
• Medusa ransomware gang

reported by cisa.govunit42.paloaltonetworks.comtrendmicro.combleepingcomputer.comcisa.gov

Ransomware Vulnerability Matrix by BushidoUK (github.com/BushidoUK/Ransomware-Vulnerability-Matrix), reformatted per CVE. CC BY 4.0

Exploitation

Active, exploited in the wild

Automatable

yes

Technical impact

total

Assessed

2 y ago (2024-02-24)

99.98% chance of exploitation in the next 30 days, higher than 99.9% of all scored CVEs (FIRST EPSS, 2026-11-08).

• Metasploit exploit/multi/http/connectwise_screenconnect_rce_cve_2024_1709 ConnectWise ScreenConnect Unauthenticated Remote Code Execution metasploit exploit, excellent rank, 2024-02-19
• Nuclei template ConnectWise ScreenConnect 23.9.7 - Authentication Bypass nuclei detection template
• huntress.com https://www.huntress.com/blog/detection-guidance-for-connectwise-cwe-288-2 referenced PoC, tagged "exploit" by a source, unverified
• github.com https://github.com/watchtowrlabs/connectwise-screenconnect_auth-bypass-add-user-poc referenced PoC, tagged "exploit" by a source, unverified
• huntress.com https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass referenced PoC, tagged "exploit" by a source, unverified

• ConnectWise ScreenConnect

Weakness

• CWE-288 Authentication Bypass Using an Alternate Path or Channel

• github.com /rapid7/metasploit-framework/pull/18870

  issue-tracking, patch, third-party-advisory

• huntress.com /blog/detection-guidance-for-connectwise-cwe-288-2

  exploit, third-party-advisory

• github.com /watchtowrlabs/connectwise-screenconnect_auth-bypass-add-user-poc

  exploit, third-party-advisory

• huntress.com /blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass

  exploit, third-party-advisory

• connectwise.com /company/trust/security-bulletins/connectwise-screenconnect-23.9.8

  vendor-advisory

• huntress.com /blog/vulnerability-reproduced-immediately-patch-screenconnect-23-9-8

  third-party-advisory

• bleepingcomputer.com /news/security/connectwise-urges-screenconnect-admins-to-patch-critical-rce-flaw/

  press/media-coverage, third-party-advisory

• horizon3.ai /attack-research/red-team/connectwise-screenconnect-auth-bypass-deep-dive/

  third-party-advisory

• techcrunch.com /2024/02/21/researchers-warn-high-risk-connectwise-flaw-under-attack-is-embarrassingly-easy-to-exploit/

  press/media-coverage, third-party-advisory

• securityweek.com /connectwise-confirms-screenconnect-flaw-under-active-exploitation/

  press/media-coverage, third-party-advisory

• cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-1709

  government-resource, us-government-resource

• CVE List CVE-2024-1709
• NVD CVE-2024-1709

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.