Critical Flaws Found in ConnectWise ScreenConnect Software - Patch Now

Executive Summary: ConnectWise released fixes for two critical ScreenConnect flaws (CVE-2024-1709 authentication bypass, CVE-2024-1708 path traversal) that affect versions up to 23.9.7; proof-of-concept exploits and active exploitation have been observed—threat actors have used the bugs to create administrative accounts, deploy Cobalt Strike and LockBit-derived ransomware (including "buhtiRansom"), and deliver RATs, stealers, and miners; CISA has added CVE-2024-1709 to its KEV catalog and vendors/incident responders report widespread opportunistic abuse and IoCs including specific attacker IPs.