The Overlooked RMM Trap: Why ConnectWise ScreenConnect CVE-2024-1708 Is Every MSP's Blind Spot

TL;DR

CISA quietly added ConnectWise ScreenConnect CVE-2024-1708 to its Known Exploited Vulnerabilities catalog on April 28, 2026—a path traversal flaw that's been weaponized in the wild for months. The vulnerability allows unauthenticated attackers to bypass directory restrictions and access sensitive files on any unpatched ScreenConnect instance. For MSPs and enterprises using ScreenConnect as their remote access backbone, this is the breach point attackers have been waiting for.

What Happened

On April 28, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) officially added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, signaling active, weaponized exploitation in the wild. Alongside the Windows Shell zero-day (CVE-2026-32202), CISA also flagged CVE-2024-1708, a path traversal vulnerability in ConnectWise ScreenConnect—one of the most widely deployed remote access platforms for managed service providers and enterprise IT teams.

The vulnerability itself was disclosed in early 2024, over two years ago. Yet despite ScreenConnect's ubiquity across the MSP ecosystem—representing millions of endpoints and customers—the flaw has continued to be exploited quietly in the wild without triggering the alarm bells that zero-days typically generate. CISA's KEV designation is a tacit admission: this isn't theoretical. This is active breach infrastructure.

Technical Details: The Path Traversal Gateway

CVE-2024-1708 is a path traversal vulnerability (CWE-22) in ConnectWise ScreenConnect that allows attackers to manipulate file path requests in a way that escapes intended directory restrictions. In plain terms: an attacker can craft malicious URL sequences—using directory traversal patterns like ../ or URL-encoded variants—to navigate outside the application's intended sandbox and access files they shouldn't be able to reach.

The attack requires no authentication. There's no login, no compromise, no user interaction needed. An attacker on the internet can send a single crafted HTTP request to any exposed ScreenConnect instance and bypass the directory restrictions that are supposed to protect sensitive system files, configuration data, and credentials.

Once an attacker has escaped the directory boundary, the impact scales quickly:

• Configuration file extraction — Access to database connection strings, API keys, and system secrets
• Credential harvesting — Session tokens, stored credentials, and cached authentication material
• Information disclosure — User databases, customer contact info, and customer infrastructure details
• Lateral movement staging — Using harvested credentials to pivot into customer environments managed by that MSP

For an MSP, a single compromised ScreenConnect instance represents access to hundreds or thousands of customer endpoints. The flaw is, in effect, a skeleton key to every lock the MSP manages.

Lyrie Assessment: The MSP Weakness Everyone Missed

ScreenConnect is infrastructure. Unlike a web application or an endpoint tool that gets reviewed, patched, and tested as part of regular security cadences, ScreenConnect is often treated as a utility—deployed once, configured, and forgotten. It's the "trusted" layer that sits between every MSP and every customer they support.

That trust is precisely why CVE-2024-1708 has been weaponized so effectively in the wild. Attackers understand MSP economics: compromising one ScreenConnect instance yields exponential return on effort. From a single vulnerable instance, an attacker can:

1. Extract credentials from the MSP's own infrastructure

2. Pivot into customer environments using the MSP's trust relationships

3. Install persistence on customer endpoints while appearing to be "authorized maintenance"

4. Remain undetected because MSP traffic is expected and trusted

CISA's KEV designation on April 28 signals that threat actors have already figured this out. The vulnerability isn't new—but its exploitation has been mature and weaponized for months. The fact that it took CISA until April 2026 to formally acknowledge active exploitation suggests either:

• Detection and response has been slow across the MSP community
• Breach detection hasn't correlated malicious activity back to this single CVE
• Exploitation has been subtle enough to evade baseline alerting

Any of those scenarios is a Lyrie Verdict indicator: your breach may have already happened, and you wouldn't know it yet.

Why CISOs and MSPs Should Care NOW

Immediate risk: Any ScreenConnect instance exposed to the internet (and they almost always are—that's the point) without the latest patches is actively exploitable right now. Threat actors have working code. CISA has confirmed active exploitation. Dwell time on this vulnerability is measured in days to weeks, not months.

Breach scope: Unlike a typical vulnerability affecting a single application, a compromised ScreenConnect instance is a blast radius that extends to every customer the MSP manages. A single compromise can translate into 100+ customer breaches within hours.

Detection blind spot: Because ScreenConnect is a trusted tool, SOC teams often whitelist or under-monitor its traffic. Malicious file access via path traversal may look indistinguishable from legitimate backup or configuration retrieval operations. Standard SIEM rules won't catch it without specific path traversal indicators.

Patch velocity nightmare: ConnectWise has released patches, but patch deployment across MSP environments is notoriously slow. Many organizations are still running versions from 2023 or earlier. For every day an MSP delays patching, the risk window expands exponentially.

Recommended Actions

Immediate (next 48 hours):

1. Identify all ScreenConnect instances in your infrastructure and note which versions are deployed

2. Check ConnectWise security advisories for CVE-2024-1708 patch availability and install dates

3. Review access logs for ScreenConnect over the past 90 days, searching for:

- Unusual URL patterns with ../ or URL-encoded traversal sequences

- Requests to paths outside the normal application directory structure

- Requests from IPs outside your trusted MSP/corporate network ranges

4. Cross-reference any suspicious activity with known threat actor IOCs and breach notification databases

Near-term (next 2 weeks):

1. Patch all ScreenConnect instances to the latest patched version from ConnectWise

2. Rotate all credentials used by ScreenConnect (database connection strings, API keys, service account passwords)

3. Review customer environment access logs for any unauthorized activity that correlates with ScreenConnect compromise windows

4. Implement network-level monitoring for ScreenConnect traffic:

- Alert on path traversal patterns in HTTP requests

- Monitor for unusual volume or timing of file access requests

- Flag requests from unexpected geographic IP addresses

Ongoing:

1. Enable ScreenConnect logging at the highest verbosity available and forward logs to a centralized SIEM

2. Implement file integrity monitoring on sensitive ScreenConnect configuration files and credential stores

3. Conduct threat hunting across customer environments with a focus on lateral movement using MSP credentials

4. Establish a patching SLA for critical infrastructure tools like ScreenConnect (48-72 hours maximum)

Sources

1. CISA Known Exploited Vulnerabilities Catalog — CVE-2024-1708 (April 28, 2026)

https://www.cisa.gov/news-events/alerts/2026/04/28/cisa-adds-two-known-exploited-vulnerabilities-catalog

2. The Hacker News — CISA Adds Actively Exploited ConnectWise and Windows Flaws to KEV (April 29, 2026)

https://thehackernews.com/2026/04/cisa-adds-actively-exploited.html

3. Red Packet Security — CVE Alert: CVE-2024-1708 - ConnectWise - ScreenConnect (April 29, 2026)

https://www.redpacketsecurity.com/cve-alert-cve-2024-1708-connectwise-screenconnect/

4. CyberPress — CISA Warns ConnectWise ScreenConnect Vulnerability Actively Exploited in Attacks (April 29, 2026)

https://cyberpress.org/connectwise-screenconnect-vulnerability/

5. Windows Forum — CISA Adds ScreenConnect Path Traversal and Windows Flaw to KEV Catalog (April 28, 2026)

https://windowsforum.com/threads/cisa-adds-screenconnect-path-traversal-and-windows-flaw-to-kev-catalog.415626/

---

Lyrie.ai Cyber Research Division