ConnectWise warns of new ScreenConnect flaw without patch

Summary

ConnectWise has identified a new vulnerability in its ScreenConnect Remote Access platform affecting file transfer behavior. While a patch is planned for later this week, the company has provided temporary mitigation steps for IT administrators to disable the 'TransferFiles' permission. This flaw comes after previous ScreenConnect vulnerabilities have been exploited by various threat actors, including ransomware gangs and nation-state groups.

Full text

ConnectWise warns of new ScreenConnect flaw without patch By Sergiu Gatlan September 7, 2026 06:06 AM 0 ConnectWise has shared temporary mitigation measures for a new ScreenConnect Remote Access vulnerability that it plans to patch later this week. ScreenConnect is an on-premises or cloud-hosted remote access platform typically used by managed service providers (MSPs), IT departments, and support teams for troubleshooting, patching, and system maintenance. The security flaw affects both cloud and on-premises deployments, and it has not yet received a CVE ID for easy tracking. "ConnectWise has identified an issue affecting file transfer behavior in ScreenConnect® Remote Access Support and Access sessions," the company said in a security advisory issued on Thursday. While ConnectWise is still working on a permanent fix for this security issue, it provided temporary mitigation steps designed to help block potential attacks. This requires IT administrators to go through the following steps: Log in to the ScreenConnect Administration page. Go to Administration > Security > Roles. Edit user roles and check session groups (in bold)with permissions assigned to them. In the Scoped Permissions window, deselect the TransferFiles permission (or TransferFilesInSession for legacy) for each session group. Save changes and repeat for all roles. Internet security watchdog Shadowserver currently tracks nearly 6,000 ScreenConnect instances exposed online. However, there is no information regarding how many of these systems are honeyposts or have already been secured. Internet-exposed ScreenConnect instances (Shadowserver) ​ScreenConnect vulnerabilities are often targeted in the wild by both financially-motivated and state-backed hacking groups. For instance, in 2024, ransomware gangs and the Kimsuky North Korean APT hacking group exploited another ScreenConnect flaw (tracked as CVE-2024-1709) to drop malware on vulnerable systems. Last year, ConnectWise disclosed that suspected state-sponsored hackers breached its systems via a high-severity ViewState code injection bug (CVE-2025-3935) and gained access to the cloud-based instances of a limited number of customers. Earlier this year, in March, ConnectWise also addressed a ScreenConnect cryptographic signature verification vulnerability (tracked as CVE-2026-3564) that could allow attackers to hijack unpatched instances. Since February 2024, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three ScreenConnect vulnerabilities to its catalog of actively exploited flaws, two of which were also abused in ransomware attacks. Once attackers have valid credentials, only 37% of their actions are blocked Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report Related Articles: Plex warns users to patch security vulnerabilities immediatelyHackers abuse Faronics Deploy admin tool to install ScreenConnectMicrosoft asks users to ignore 'Antivirus is turned off' errorsHackers target Microsoft SharePoint RCE chain with PoC exploitWhatsApp rolls out new feature that flags potential scam messages

Entities