Skip to content

ConnectWise product

ScreenConnect

Alert
No CISA KEV deadline is open. CISA last added a ScreenConnect CVE on 11 Sep.

Tracked since 19 Mar · latest article 14 Sep · RSS · API

0Open KEV deadlines

None open

1Added to KEV · 90 days

of 4 in the full CISA catalogue · all time

0High exploit odds · current

EPSS top 5%, not in KEV

0Articles · 7 days

none this week

Exploited, by due date4

ScreenConnect CVEs in CISA KEV with their federal deadlines. None is open.

Exploited ScreenConnect CVEs
CVEProductAddedFederal deadlineArticles
In CISA KEVCVE-2026-84869ScreenConnect11 SepPassed 14 Sep5
In CISA KEVCVE-2024-1708RansomwareScreenConnect28 AprPassed 12 May4
In CISA KEVCVE-2025-3935ScreenConnect2 JunPassed 23 Jun–
In CISA KEVCVE-2024-1709RansomwareScreenConnect22 FebPassed 29 Feb1
CSV of 4 entries

Patch cadence and exploit odds

How often CISA adds ScreenConnect CVEs, how many have a fix, and where their exploit odds sit.

Added to CISA KEV per quarter

0Q1 ’251Q2 ’250Q3 ’250Q4 ’250Q1 ’261Q2 ’261Q3 ’260Q4 ’26
Show as table
Added to CISA KEV per quarter
QuarterAdded
Q1 20250
Q2 20251
Q3 20250
Q4 20250
Q1 20260
Q2 20261
Q3 20261
Q4 20260

Fix listed

4 of 4 CVEs in coverage

Every CVE in coverage has a fix recorded.

EPSS percentile of each CVE

One dot per CVE; a red diamond marks those in CISA KEV.

top 5%CVE-2024-1709: 100th percentile, in CISA KEVCVE-2024-1708: 99.9th percentile, in CISA KEVCVE-2026-84869: 60.2th percentile, in CISA KEVCVE-2026-3564: 30.5th percentile050100
Show as table
FIRST EPSS percentiles across CVEs in coverage
CVEEPSS percentile
CVE-2024-1709100
CVE-2024-170899.9
CVE-2026-8486960.2
CVE-2026-356430.5

Coverage10 articles · all time

The latest 10 articles naming ScreenConnect, in the shared story grammar.

Full timeline
Quiet for 6 weekslast report 14 Sep10 articles5 outlets

10 articles from 5 outlets since 19 Mar. Quiet since 14 Sep.

Now19 Mar2713202710 Sep21284915First reportSecurityWeek · 19 Mar, 18:06CISA alert28 Apr, 20:12 · official
  • Thu 19 Mar, 18:06 UTC. SecurityWeek, first report. Critical ScreenConnect Vulnerability Exposes Machine Keys.
  • Tue 28 Apr, 20:12 UTC. CISA, its first report on the story. CISA Flags Critical ScreenConnect Flaw CVE‑2024‑1708 as Exploited. Cites a CVE in CISA KEV.
  • Tue 28 Apr, 20:57 UTC. CISA. CISA Flags Critical ScreenConnect Flaw CVE‑2024‑1708 as Exploited. Cites a CVE in CISA KEV.
  • Wed 29 Apr, 08:31 UTC. Security Affairs, its first report on the story. CISA Adds ConnectWise ScreenConnect Path Flaw and Windows Shell Bug. Cites a CVE in CISA KEV.
  • Wed 29 Apr, 09:11 UTC. The Hacker News, its first report on the story. CISA Flags Actively Exploited CVE-2024-1708 and Windows Flaw. Cites a CVE in CISA KEV.
  • Fri 11 Sep, 20:32 UTC. CISA. Actively Exploited ScreenConnect Flaw Enables Unauthorised File Execution. Cites a CVE in CISA KEV.
  • Sat 12 Sep, 09:11 UTC. SecurityOnline, its first report on the story. CISA Warns of Active ScreenConnect Flaw Enabling File Execution. Cites a CVE in CISA KEV.
  • Mon 14 Sep, 03:11 UTC. SecurityOnline. CISA Tracks Exploitation of Critical N-central, GitLab and MikroTik Flaws. Cites a CVE in CISA KEV.
  • Mon 14 Sep, 09:00 UTC. SecurityWeek. ConnectWise Patches ScreenConnect Flaw Exploited in Worm Attacks. Cites a CVE in CISA KEV.
  • Mon 14 Sep, 15:26 UTC. Security Affairs. CISA Flags Artifactory, ScreenConnect and GitLab Flaws as Exploited. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • CVE not in KEV
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 10 articles as a list
  1. Thu 19 MarDay 01
    1. Critical ScreenConnect Vulnerability Exposes Machine Keys18:06 · SecurityWeek · First report

  2. Quiet for 6 weeks

    Tue 28 AprDay 402
    1. CISA Flags Critical ScreenConnect Flaw CVE‑2024‑1708 as Exploited20:12 · CISA · official · CISA alert · Picked up again · Known exploited CVE
    2. CISA Flags Critical ScreenConnect Flaw CVE‑2024‑1708 as Exploited20:57 · CISA · official · Known exploited CVE
  3. Wed 29 AprDay 412
    1. CISA Adds ConnectWise ScreenConnect Path Flaw and Windows Shell Bug08:31 · Security Affairs · Known exploited CVE
    2. CISA Flags Actively Exploited CVE-2024-1708 and Windows Flaw09:11 · The Hacker News · Known exploited CVE

  4. Quiet for 19 weeks

    Fri 11 SepDay 1761
    1. Actively Exploited ScreenConnect Flaw Enables Unauthorised File Execution20:32 · CISA · official · Picked up again · Known exploited CVE
  5. Sat 12 SepDay 1771
    1. CISA Warns of Active ScreenConnect Flaw Enabling File Execution09:11 · SecurityOnline · Known exploited CVE

  6. Quiet for 2 days

    Mon 14 SepDay 1793
    1. CISA Tracks Exploitation of Critical N-central, GitLab and MikroTik Flaws03:11 · SecurityOnline · Known exploited CVE
    2. ConnectWise Patches ScreenConnect Flaw Exploited in Worm Attacks09:00 · SecurityWeek · Known exploited CVE
    3. CISA Flags Artifactory, ScreenConnect and GitLab Flaws as Exploited15:26 · Security Affairs · Known exploited CVE

All CVEs in coverage4

Exploited first, then by EPSS

In the CVE tracker
  • CVE-2024-1709Exploited

    ConnectWise ScreenConnect Authentication Bypass Vulnerability

    10.0Critical99.9% EPSS · 1 article
  • CVE-2024-1708Exploited

    ConnectWise ScreenConnect Path Traversal Vulnerability

    8.4High95% EPSS · 4 articles
  • CVE-2026-84869Exploited

    ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability

    9.9Critical0.9% EPSS · 5 articles
  • CVE-2026-3564

    ScreenConnect Instance Level Cryptographic Material Exposure

    9.0Critical0.4% EPSS · 1 article
CyberSIXTSignal over noise
Updated AboutDevelopersSign in