connectwise-screenconnect_auth-bypass-add-user-poc

CVE-2024-1708 and CVE-2024-1709 A Proof of Concept developed by @watchTowr to exploit an authentication bypass to add a new administrative user in ConnectWise ScreenConnect. This is the first step in a trivial Remote Command Execution chain. Follow the watchTowr Labs Team for our Security Researc...

ScreenConnect-UserEnum

ScreenConnect-UserEnum ConnectWise also known as ScreenConnect has a userenum vulnerability. This is an user enumeration tool for that CVE-2019-16516 vulnerable = 19.2.24707 ??? didn't really understand if they fixed in upper version...

cve-2024-1708-connectwise_rce_reproduction

CVE-2024-1708 / CVE-2024-1709 — ConnectWise ScreenConnect Authentication Bypass & Remote Code Execution CVSS Score: 8.4 CVE-2024-1708 – 10.0 CVE-2024-1709 CWE: CWE-22 Path Traversal, CWE-288 Authentication Bypass Using an Alternate Path Affected Software: ConnectWise ScreenConnect formerly...

CVE-2024-1709-ConnectWise-ScreenConnect-Authentication-Bypass

ConnectWise ScreenConnect: Authentication Bypass Introduction This project aims to exploit an authentication bypass vulnerability in ConnectWise ScreenConnect. It provides a script to demonstrate the exploit. Please ensure you have the necessary permissions before attempting to use this script...

SCKit abuses ScreenConnect to deploy remote access and target technician sessions

In this article 1. ScreenConnect architecture and attack surfaces 2. Attack chain overview 3. Mitigation and protection guidance 4. Indicators of compromise and supporting artifacts 5. References 6. Learn More Beginning on November 11, 2026, ConnectWise reported an active campaign of a threat act...

ConnectWise ScreenConnect <= 23.9.7 - Path Traversal

ConnectWise ScreenConnect 23.9.7 and prior contain a path traversal caused by improper handling of user input, letting attackers execute remote code or access confidential data, exploit requires network access. id: CVE-2024-1708 info: name: ConnectWise ScreenConnect = 23.9.7 - Path Traversal...

ConnectWise ScreenConnect 23.9.7 - Authentication Bypass

ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel vulnerability, which may allow an attacker direct access to confidential information or critical systems. id: CVE-2024-1709 info: name: ConnectWise ScreenConnect 23.9.7 -...

CVE-2026-127063

The third-party RMM+ extension for ConnectWise ScreenConnect uses a static API secret by default. The value can be changed by an administrator; however, environments retaining the default value may allow unauthorized access to extension API functionality, including the ability to send commands to...

CVE-2026-127063

The third-party RMM+ extension for ConnectWise ScreenConnect uses a static API secret by default. The value can be changed by an administrator; however, environments retaining the default value may allow unauthorized access to extension API functionality, including the ability to send commands to...

CVE-2026-127063

The third-party RMM+ extension for ConnectWise ScreenConnect is vulnerable to unauthorized access due to the use of a static API secret by default (CWE-1392 ). If the default value is retained, attackers may access extension API functionality, including the ability to send commands to managed age...

EUVD-2026-124597

The third-party RMM+ extension for ConnectWise ScreenConnect uses a static API secret by default. The value can be changed by an administrator; however, environments retaining the default value may allow unauthorized access to extension API functionality, including the ability to send commands to...

SCKit Malware Turns ScreenConnect Support Sessions Into Potential MSP Attack Paths

The ongoing campaign targeting ConnectWise ScreenConnect deployments involves the exploitation of a now-patched critical security flaw in the remote access software, and not a new vulnerability, it has emerged. Blackpoint Cyber's Adversary Pursuit Group APG, which shared the details with The Hack...

PT-2026-145909

Name of the Vulnerable Software and Affected Versions DataComm RMM+ extension for ConnectWise ScreenConnect affected versions not specified Description The third-party RMM+ extension for ConnectWise ScreenConnect uses a static API secret by default. If an administrator does not change this value,...

Hackers Pushing Remote Access Tool Through Fake Adobe Acrobat Pages

Fake Adobe Acrobat pages distribute signed ScreenConnect installers configured for attacker-controlled remote access to Windows PCs, CloudSEK’s researchers say...

connectwise-screenconnect_auth-bypass-add-user-poc

CVE-2024-1708 e CVE-2024-1709 Una prova di concetto sviluppata da @watchTowr per sfruttare un bypass dell'autenticazione al fine di aggiungere un nuovo utente amministrativo in ConnectWise ScreenConnect. Questo è il primo passo di una banale catena di esecuzione remota di comandi. Segui il team d...

ConnectWise ScreenConnect Guest Transfer (CVE-2026-84869)

Targets CVE-2026-84869 in ScreenConnect before 26.6.5.9742: guest file transfer without Host confirmation during active sessions. Validates vulnerable build markers and probes guest-accessible transfer endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """ConnectWise ScreenConnect guest file...

Attackers Abuse MSP360 to Deploy ScreenConnect in Dual-RMM Phishing Attacks

Microsoft has warned of phishing campaigns distributing an installer for the MSP360 Remote Monitoring and Management RMM software under the guise of meeting invitations, PDF-themed lures, software update prompts, and other social-engineering content. "Once executed, the legitimate MSP360 installe...

Phishing Abuses RMM Tools for Persistent Access

In this article 1. Attack chain overview 2. Mitigation and protection guidance 3. Learn More In July 2026, Microsoft Defender Experts observed phishing campaigns targeting organizations across multiple industries that distributed a masqueraded MSP360 Remote Monitoring and Management RMM installer...

ConnectWise ScreenConnect CVE-2026-84869 Detect

Detects ScreenConnect server deployments likely serving vulnerable client builds before 26.6.5.9742 CVE-2026-84869: guest file transfer without Host confirmation during active sessions. Parses version markers from Login/Host pages and flags releases below 26.6.5. !/usr/bin/env python3 -- coding:...

CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV

The U.S. Cybersecurity and Infrastructure Security Agency CISA has added five security flaws impacting JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS to its Known Exploited Vulnerabilities KEV catalog, following reports of active exploitation in the wild. Details of the...