ConnectWise ScreenConnect Path Traversal Vulnerability (CVE-2024-1708)

Historical catalog analysis: CISA added this entry on April 28, 2026. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2024-1708 is a path traversal vulnerability (CWE-22) identified in ConnectWise ScreenConnect. This flaw could allow an unauthorized actor to execute remote code or directly impact critical systems and confidential data. CISA has noted that this vulnerability is known to be used in ransomware campaigns, increasing the risk profile for organizations utilizing this tool for remote administration.

Exposure and applicability

This vulnerability is applicable to healthcare providers, health plans, and business associates who utilize ConnectWise ScreenConnect for remote support or system management. Because these tools often have high-level privileges to facilitate administrative tasks, a compromise could provide an entry point into the broader network where electronic Protected Health Information (ePHI) is stored.

In a clinical environment, the potential for remote code execution poses a risk not only to data confidentiality but also to operational resilience. If critical systems are impacted by ransomware via this vector, it could disrupt patient care delivery and administrative workflows.

Remediation priorities

Based on our analysis of the vulnerability’s association with ransomware, we suggest the following prioritized actions:

1. Immediate Version Verification: Security leaders should identify all instances of ScreenConnect in use across the environment to determine if they are running a vulnerable version.
2. Apply Vendor Mitigations: Following vendor instructions to apply available patches or mitigations is the primary method to reduce the likelihood of exploitation.
3. Cloud Service Review: For organizations using cloud-hosted versions, we recommend reviewing guidance related to BOD 22-01 to ensure the service provider has addressed the flaw.
4. Decommissioning: If mitigations are unavailable or cannot be applied due to legacy constraints, our analysis suggests discontinuing use of the product to eliminate the attack vector.

How to validate remediation

To verify that exposure has been reduced, organizations should employ the following methods:

• Version Audit: Confirm through administrative consoles or package managers that the installed version matches the vendor’s remediated release.
• Configuration Review: Verify that any required configuration changes specified in the vendor’s security bulletin have been applied across all deployed instances.

Note that while these steps reduce exposure, a version check alone does not guarantee total security against all possible attack vectors.

Limits and open questions

It remains unclear exactly which versions of ScreenConnect are affected without referencing the specific vendor security bulletins. Additionally, while applying mitigations could reduce the likelihood of an initial compromise, residual risk remains if other vulnerabilities exist within the environment or if credentials have already been compromised prior to patching.

Source and editorial note

CVE-2024-1708: ConnectWise ScreenConnect Path Traversal Vulnerability · Source date: April 28, 2026 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: May 01, 2026. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: September 11, 2026 at 00:53 UTC.

Request a healthcare security assessment