ConnectWise ScreenConnect 23.9.7 and prior contain a path-traversal flaw (CWE-22, rated 8.4 high) that can allow an attacker to execute remote code or access confidential data and critical systems. Public analysis (Huntress) shows it is triggered by manipulating directory paths in the product's administrative setup wizard, and that it is typically chained with a companion authentication-bypass flaw (CVE-2024-1709) disclosed at the same time to achieve unauthenticated remote code execution on the ScreenConnect server. An attacker who compromises a ScreenConnect server gains control of the remote-access platform itself and can pivot to every endpoint that server manages, making it an efficient foothold for ransomware. Any organization running ScreenConnect 23.9.7 or earlier is affected, most commonly MSPs and IT teams that use the tool to manage client and internal machines. The flaw is being actively exploited in the wild: it is listed in CISA's Known Exploited Vulnerabilities catalog with known ransomware use, EPSS puts the 30-day exploitation probability at 95.5% (100th percentile), and recent reporting ties fast-moving exploitation to the Storm-1175 activity cluster, which drops Medusa ransomware.
What to do: Immediately update all self-hosted ScreenConnect instances to a release newer than 23.9.7 per ConnectWise's advisory, and ensure the companion authentication-bypass flaw (CVE-2024-1709) is patched at the same time; federal agencies must follow BOD 22-01 mitigation timelines per the KEV listing. Because exploitation is fast-moving and linked to ransomware operations, hunt for signs of compromise such as unexpected new administrative accounts, setup-wizard activity, or unusual remote sessions on exposed servers. Separately, ConnectWise has disclosed a breach of its own infrastructure by a nation-state actor, so review vendor communications for any updated guidance.
Affected
ConnectWise ScreenConnect
23.9.7 and prior
Estimated exposure
large≈ tens of thousands of ScreenConnect deployments (thousands of internet-exposed servers; millions of managed endpoints) — ScreenConnect is a widely deployed remote-support/remote-management platform concentrated in MSP and IT-provider environments, so public internet scans show thousands of exposed server instances and the installed base plausibly spans tens…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
ConnectWise ScreenConnect 23.9.7 and prior are affected by path-traversal vulnerability, which may allow an attacker the ability to execute remote code or directly impact confidential data or critical systems.
CISA Known Exploited Vulnerability
Affected
ConnectWise ScreenConnect
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Microsoft reports China-linked ransomware group Storm-1175 switched from Medusa to a new C++ strain, StormEncryptor, likely exploiting N-able flaw CVE-2026-18577.
Microsoft Threat Intelligence reports that the financially motivated, China-linked group Storm-1175 began deploying a new ransomware strain called StormEncryptor on August 2, 2026, replacing its previous Medusa ransomware. StormEncryptor is written in C++, appends the .encrypted extension to files, and drops a !!!README_FIRST!!!.txt ransom note in each scanned directory. Microsoft assesses the group is likely exploiting CVE-2026-18577, an authentication bypass in N-able disclosed on August 2, 2026 and added to CISA's Known Exploited Vulnerabilities catalog the next day. Since 2023, Storm-1175 has exploited more than 16 vulnerabilities in products including Microsoft Exchange, Ivanti, ConnectWise ScreenConnect, JetBrains TeamCity, SimpleHelp, CrushFTP, and GoAnywhere MFT, often moving from initial access to data theft and ransomware deployment within days.