CISA Warns of Active Attacks Exploiting ConnectWise ScreenConnect and Windows Vulnerabilities

Overview of the Latest KEV Additions

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has expanded its Known Exploited Vulnerabilities (KEV) catalog to include two security flaws that are currently being exploited in the wild. The vulnerabilities affect ConnectWise ScreenConnect and a Microsoft Windows component, underscoring the urgent need for organizations to patch these weaknesses. According to CISA's advisory released on [date], evidence of active exploitation prompted the addition, signaling immediate risk to users who have not yet applied updates.

Vulnerability Details

ConnectWise ScreenConnect Path Traversal (CVE-2024-1708)

The first vulnerability, tracked as CVE-2024-1708 with a CVSS score of 8.4 (High), is a path traversal flaw in ConnectWise's remote support software, ScreenConnect. An attacker can exploit this issue to access files and directories stored outside the intended web root folder. This can lead to unauthorized disclosure of sensitive data, such as configuration files or credentials, and could serve as a stepping stone for further compromise. The vulnerability resides in the way ScreenConnect handles file paths, allowing a malicious actor to craft requests that bypass security restrictions.

Microsoft Windows Vulnerability (Unspecified CVE)

The second entry in the KEV catalog pertains to a Microsoft Windows flaw, although CISA did not disclose its CVE identifier in the original announcement. What is known is that this vulnerability has been observed under active attack, and organizations running affected versions of Windows should treat this as a critical risk. Typically, such flaws involve privilege escalation, remote code execution, or similar vectors that could allow an attacker to gain control over a system. Users are advised to consult Microsoft's Security Response Center for the latest patches and advisories.

Impact and Active Exploitation

Active exploitation means that threat actors are actively using these vulnerabilities to compromise systems before patches can be widely applied. In the case of CVE-2024-1708, security researchers have already reported instances where malicious actors leveraged the path traversal to extract configuration files from ScreenConnect servers, potentially gaining access to remote control sessions. For the Windows flaw, attacks typically target unpatched endpoints to deploy ransomware or steal sensitive data. CISA's inclusion of these flaws in the KEV catalog serves as a mandatory directive for federal agencies to patch within specified timelines (usually three weeks), and it strongly encourages all private sector organizations to follow suit.

Mitigation and Recommendations

Organizations using ConnectWise ScreenConnect should immediately update to the latest version, which fixes CVE-2024-1708. ConnectWise released patches on [date] and users can find details on their security advisory page. For Windows, apply all recently released security updates from Microsoft, especially those addressing privilege escalation or remote code execution vulnerabilities. General best practices to minimize risk include:

• Enable automatic updates for both operating systems and third-party software.
• Segment networks to limit exposure of remote management tools like ScreenConnect.
• Monitor logs for suspicious file access patterns that could indicate path traversal attempts.
• Implement multi-factor authentication for all administrative interfaces.
• Use vulnerability scanning tools to identify unpatched systems quickly.

For federal agencies, the Binding Operational Directive (BOD) 22-01 requires that all KEV-listed vulnerabilities be remediated by the due date specified in the catalog. Even outside the public sector, history shows that attackers actively scan for these known flaws, so prompt patching is essential.

Conclusion

CISA's addition of the ConnectWise ScreenConnect path traversal vulnerability and the Windows flaw to the KEV catalog highlights the persistent threat of actively exploited weaknesses. Organizations must treat these vulnerabilities with high priority to prevent data breaches and ransomware attacks. By staying informed and applying patches without delay, defenders can significantly reduce their attack surface. For ongoing updates, bookmark CISA's KEV catalog page.