Critical Vulnerabilities in ConnectWise ScreenConnect Patched

On February 19, 2024 ConnectWise published an advisory for two critical vulnerabilities in on‑premises ScreenConnect (an authentication bypass rated CVSS 10 and a path traversal rated CVSS 8.4) that could lead to remote code execution; cloud-hosted ScreenConnect instances have been patched and on‑premises users should upgrade to 23.9.8 immediately. Arctic Wolf warns threat actors are likely to target these severe, low-complexity flaws given ScreenConnect's historical abuse, but reports no observed exploitation or public PoCs at this time.