# ConnectWise ScreenConnect Path Traversal (CVE-2024-1708) Added to CISA KEV — Storm-1175 / Medusa Ransomware Active Exploitation

> On April 28, 2026, CISA added CVE-2024-1708, a ConnectWise ScreenConnect path traversal vulnerability (CWE-22, CVSS 8.4), to the Known Exploited Vulnerabilities catalog with an FCEB remediation deadline of May 12, 2026. The flaw affects on-premises ScreenConnect 23.9.7 and prior and is being chained with the paired authentication-bypass CVE-2024-1709 (CVSS 10.0) to achieve unauthenticated remote code execution. Microsoft Threat Intelligence attributes the high-tempo exploitation to Storm-1175, a financially motivated Medusa ransomware affiliate targeting healthcare, education, professional services and finance organizations across Australia, the United Kingdom and the United States.

- **Published:** 2026-04-30T00:33:41Z
- **Last reviewed:** 2026-04-30T00:33:41Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0436
- **ID:** TL-2026-0436
- **Severity:** HIGH (CVSS 8.4)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** Storm-1175 (China)
- **Detections:** 9 · **IOCs:** 19 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2024-1708, CVE-2024-1709

## Description

CVE-2024-1708 is a path traversal vulnerability (CWE-22) in the ConnectWise ScreenConnect web management interface that affects all on-premises versions 23.9.7 and earlier. The flaw resides in how the application validates and constructs file paths when handling extension uploads via the App_Extensions subsystem. By submitting attacker-controlled path segments containing parent-directory references, an authenticated administrator (or an attacker who has obtained admin via the paired bypass) can write arbitrary files outside the intended extensions directory and into web-accessible locations under the ScreenConnect installation tree. When combined with the ability to upload .aspx content, this primitive yields reliable unauthenticated remote code execution under the ScreenConnect service account, which on Windows installations runs with elevated privileges.

In observed in-the-wild operations, CVE-2024-1708 is invariably chained with CVE-2024-1709, an authentication bypass (CWE-288, CVSS 10.0) in the SetupWizard component. CVE-2024-1709 stems from missing access control on the /SetupWizard.aspx endpoint when accessed via a path that includes a trailing path segment (for example /SetupWizard.aspx/anything). On a fully-installed instance this endpoint should reject access, but the routing logic strips or fails to authenticate the supplemental path, returning the initial setup form to anonymous callers. The attacker walks the wizard, creates a brand new local administrator on the ScreenConnect tenant, authenticates with that account, and then leverages the path-traversal primitive in CVE-2024-1708 to drop a web shell or extension that yields code execution. The composite result is full unauthenticated takeover of the ScreenConnect server and any endpoint enrolled into it — every managed device becomes reachable for command execution, file transfer and on-demand remote access.

ConnectWise was notified of both flaws by researchers at Outpost24 (Mick Behrens) on February 13, 2024 and released ScreenConnect 23.9.8 on February 19, 2024 to remediate the chain on the on-premises product line; cloud tenants on screenconnect.com and hostedrmm.com were patched directly by ConnectWise. Within hours of disclosure, Huntress published full technical analysis with screenshots and a working proof-of-concept, and within 48 hours mass exploitation by multiple ransomware affiliates was reported, including Black Basta, BlackCat/ALPHV, LockBit and Cl0p clusters. CVE-2024-1709 was added to the CISA KEV catalog on February 22, 2024.

In April 2026, Microsoft Threat Intelligence published a detailed campaign report titled 'Storm-1175 focuses gaze on vulnerable web-facing assets in high-tempo Medusa ransomware operations'. Microsoft assesses with high confidence that Storm-1175, a financially motivated actor and prolific Medusa Ransomware-as-a-Service affiliate, has industrialized the CVE-2024-1708/1709 chain alongside other web-facing exposures (Fortinet FortiOS, GeoServer, JetBrains TeamCity) as primary entry points. Following exploitation of ScreenConnect, Storm-1175 deploys legitimate remote management tooling — most commonly Mesh Agent, SimpleHelp, and AnyDesk — for redundant persistence, then performs Active Directory reconnaissance, credential dumping via comsvcs.dll-based LSASS dumps, lateral movement using harvested credentials and RDP, and finally double-extortion deployment of Medusa ransomware. Data exfiltration is staged via Rclone to attacker-controlled cloud buckets, with BITSAdmin frequently used to stage tooling. Microsoft observed intrusions impacting healthcare, education, professional services and finance verticals across Australia, the United Kingdom and the United States, with leak-site listings consistent with the campaign timeline.

CISA added CVE-2024-1708 to the KEV catalog on April 28, 2026 — more than two years after disclosure — citing direct evidence of active exploitation surfaced by Microsoft and incident response partners. Federal civilian executive branch agencies are required to remediate by May 12, 2026. Persistent unpatched on-premises ScreenConnect deployments (versions <= 23.9.7) remain trivially exploitable; defenders should treat any internet-exposed ScreenConnect server below 23.9.8 as actively targeted, audit for unauthorized administrator accounts, search App_Extensions and adjacent web roots for unknown .aspx files, and hunt for outbound connections to known Storm-1175 staging infrastructure including 155.133.5.15 and 155.133.5.14.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1059 Command and Scripting Interpreter
- T1505 Server Software Component
- T1136 Create Account
- T1543 Create or Modify System Process
- T1078 Valid Accounts
- T1685 Disable or Modify Tools
- T1070 Indicator Removal
- T1003 OS Credential Dumping
- T1082 System Information Discovery
- T1087 Account Discovery
- T1018 Remote System Discovery
- T1021 Remote Services
- T1219 Remote Access Tools
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1567 Exfiltration Over Web Service
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery

## Sources

- [CISA Alert — CISA Adds Two Known Exploited Vulnerabilities to Catalog (CVE-2024-1708 added 2026-04-28)](https://www.cisa.gov/news-events/alerts/2026/04/28/cisa-adds-two-known-exploited-vulnerabilities-catalog)
- [CISA Known Exploited Vulnerabilities Catalog — CVE-2024-1708 entry](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-1708)
- [ConnectWise Security Bulletin — ScreenConnect 23.9.8 security fix](https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8)
- [NVD — CVE-2024-1708 (Path Traversal in ConnectWise ScreenConnect)](https://nvd.nist.gov/vuln/detail/CVE-2024-1708)
- [NVD — CVE-2024-1709 (Authentication Bypass in ConnectWise ScreenConnect)](https://nvd.nist.gov/vuln/detail/CVE-2024-1709)
- [Microsoft Threat Intelligence — Storm-1175 focuses gaze on vulnerable web-facing assets in high-tempo Medusa ransomware operations](https://www.microsoft.com/en-us/security/blog/2026/04/06/storm-1175-focuses-gaze-on-vulnerable-web-facing-assets-in-high-tempo-medusa-ransomware-operations/)
- [Huntress — A Catastrophe for Control: Understanding the ScreenConnect Authentication Bypass](https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass)
- [Huntress — Vulnerable ConnectWise ScreenConnect Servers and Public PoC](https://www.huntress.com/blog/vulnerability-reproduced-immediately-patch-screenconnect-23-9-8)
- [Mandiant — Investigating ScreenConnect Mass Exploitation](https://cloud.google.com/blog/topics/threat-intelligence/connectwise-screenconnect-exploitation/)
- [CISA Stopransomware — #StopRansomware: Medusa Ransomware Advisory (AA25-071A reference)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0436