# ConnectWise ScreenConnect auth bypass via an alternate path

Source: https://startwithidentity.com/cves/cve-2024-1709/
Last updated: 2026-08-29
License: content by Start with Identity. Cite the source URL.

---

## What broke

ConnectWise ScreenConnect through 23.9.7 left an alternate SetupWizard path that did not require authentication (CWE-288). An unauthenticated caller finished setup again and created an administrator. Huntress reproduced it the day of disclosure (19 February 2024). CISA added it to KEV. CVSS 10.0. CVE-2024-1708 is the companion path traversal. Together they are RCE.

## Why it matters

ScreenConnect is how MSPs and internal IT remote into everything. An auth bypass there is a meta-IdP, the same class as [N-able N-central](https://startwithidentity.com/cves/cve-2026-18577/) and [PaperCut](https://startwithidentity.com/cves/cve-2023-27351/). Exploitation started immediately. "We will patch next change window" was the wrong sentence.

## What to do

- Upgrade to ScreenConnect 23.9.8 or later. If the box was internet-facing on 19-21 February 2024, rebuild it.
- Hunt for admin users created through SetupWizard, unexpected extensions, and new remote sessions.
- Take the management UI off the internet. Put it behind [phishing-resistant MFA](https://startwithidentity.com/glossary/phishing-resistant-mfa/) and a jump path.

## After you patch

Remote management and support platforms are standing administrative access to every endpoint beneath them, which turns a single bypass into a many-customer incident.

- **Revoke sessions and rotate the platform's own credentials**, including agent enrolment keys.
- **Review remote session logs** for connections you cannot attribute to a technician.
- **Look for independent egress the attacker may have added**, such as new tunnel services or remote access tools on managed endpoints, because removing them from the console does not remove them from the network.
- **Treat the platform as tier-zero [privileged access](https://startwithidentity.com/guides/fundamentals/what-is-pam/)** in your access model going forward, not as IT tooling.

## Sources

- [NVD: CVE-2024-1709](https://nvd.nist.gov/vuln/detail/CVE-2024-1709)
- CISA KEV
- Huntress, "A Catastrophe For Control," February 2024