ConnectWise ScreenConnect versions 23.9.7 and prior contain a CWE-22 path traversal vulnerability. This vulnerability enables an attacker with high privileges and requiring user interaction to bypass pathname restrictions, potentially leading to remote code execution and unauthorized access to confidential data or critical systems. The CVSS 3.1 base score is 8.4, reflecting network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and the product is not a cloud service.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code remotely and compromise confidentiality, integrity, and availability of the affected system. This could lead to unauthorized access to sensitive data and disruption of critical system operations. However, exploitation requires high privileges and user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected ScreenConnect instances to trusted users only and monitor for unusual activity. Avoid granting unnecessary high privileges to users. Follow vendor communications closely for updates on patches or official mitigations.