CISA Warns of Active Exploitation of Critical ConnectWise ScreenConnect Flaw

CISA has confirmed that attackers are actively exploiting a critical-severity vulnerability in ConnectWise ScreenConnect, identified as CVE-2024-1709. The agency added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on September 16, 2026, and issued a binding operational directive (BOD 23-02) requiring federal civilian executive branch agencies to remediate the vulnerability by September 30, 2026.

The vulnerability, which was disclosed earlier in 2024, allows remote code execution on affected ScreenConnect installations. ConnectWise has released patches to address the issue, but the active exploitation indicates that many systems remain unpatched. CISA's directive underscores the urgency, as the flaw poses a significant risk to organizations that rely on ScreenConnect for remote support and access.

While the exact attack vectors and victim counts are not detailed in the available information, the inclusion in the KEV catalog signals that the vulnerability is being leveraged in real-world attacks. Organizations using ScreenConnect, whether on-premises or in the cloud, should treat this as a high-priority threat and apply the latest updates without delay.

CISA's BOD 23-02 applies to federal agencies, but all organizations are strongly encouraged to follow the same patching timeline to mitigate the risk of compromise. The potential impact includes full system compromise, lateral movement within networks, and unauthorized access to sensitive data.