ConnectWise disclosed two (2) critical vulnerabilities in ScreenConnect, its remote desktop software, which have been actively exploited by attackers. The vulnerabilities, tracked as CVE-2024-1708 (an authentication bypass) and CVE-2024-1709 (a path traversal flaw), affect servers running ScreenConnect version 23.9.7 and earlier. The authentication bypass flaw allows attackers to create new administrator accounts via the setup wizard, while the path traversal flaw can be exploited to access or modify sensitive files outside of restricted directories. In response, ConnectWise has urged administrators to update their on-premise servers while cloud instances have already been secured. Multiple ScreenConnect accounts have been compromised following the disclosure. Cybersecurity researchers from Huntress highlighted the ease of developing exploits for these vulnerabilities, noting that over 8,800 vulnerable servers were initially found exposed online, a number which later decreased to about 3,800. The vulnerabilities were quickly exploited by threat actors, prompting Huntress to release a detailed analysis to encourage quicker remediation efforts. Huntress has also shared indicators of compromise (linked below) and detection guidance to assist administrators in protecting against these exploits. CTIX analysts urge all administrators using ScreenConnect to ensure that they are running the patched software to prevent exploitation.