ConnectWise ScreenConnect Path Traversal Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2026-04-28
• Known to be used in ransomware campaigns
• EPSS: 95% chance of exploitation in the next 30 days (higher than 100% of CVEs)

[ Description ]Official description

ConnectWise ScreenConnect 23.9.7 and prior are affected by path-traversal vulnerability, which may allow an attacker the ability to execute remote code or directly impact confidential data or critical systems.

CISA: ConnectWise ScreenConnect contains a path traversal vulnerability which could allow an attacker to execute remote code or directly impact confidential data and critical systems.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 12 May 2026): Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8Vendor Advisory
• www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authent…ExploitThird Party Advisory
• www.cisa.gov/known-exploited-vulnerabilities-catalogThird Party AdvisoryUS Government Resource
• www.microsoft.com/en-us/security/blog/2026/04/06/storm-1175-focuses-gaze-on-vulnerable-…Technical Description