ConnectWise warns of ScreenConnect flaw with no patch available

ConnectWise has disclosed a new vulnerability affecting file transfers in its ScreenConnect Remote Access platform. A permanent patch is not yet available, so the company has issued temporary mitigation instructions for customers.

The ScreenConnect flaw affects both cloud-hosted and on-premises deployments. However, ConnectWise has not yet assigned it a CVE identifier or disclosed detailed technical information about the issue.

Managed service providers, IT departments and support teams commonly use ScreenConnect for remote troubleshooting and system maintenance. Therefore, a security weakness in the platform could place many connected business environments at risk.

ScreenConnect flaw affects file transfers

ConnectWise said it had identified an issue affecting file transfer behaviour during ScreenConnect Remote Access Support and Access sessions.

The company is developing a permanent fix and plans to release it later this week. In the meantime, administrators should disable the affected file transfer permissions to reduce the risk of an attack.

ConnectWise advised administrators to open the ScreenConnect Administration page and navigate to the security roles section. They should then review every user role and its assigned session groups.

For each group, administrators should disable the “TransferFiles” permission. Legacy environments may list the same control as “TransferFilesInSession.” They must then save the changes and repeat the process for every affected role.

The mitigation will restrict file transfers until the permanent update becomes available. As a result, it may affect some support workflows, but it can also reduce potential exposure.

Nearly 6,000 instances exposed online

The Shadowserver Foundation currently tracks almost 6,000 internet-accessible ScreenConnect instances. However, it remains unclear how many are honeypots or already use protective measures.

ConnectWise has not reported active exploitation of the new vulnerability. Nevertheless, internet-facing remote access systems remain attractive targets because they can provide direct access to managed devices.

Administrators should apply the temporary mitigation immediately and monitor ConnectWise’s advisory for the upcoming patch. They should also review logs for unexpected file transfers or other suspicious activity.

Attackers have targeted ScreenConnect before

Both financially motivated criminals and state-sponsored groups have previously exploited ScreenConnect vulnerabilities.

In 2024, ransomware operators and the North Korean Kimsuky group exploited CVE-2024-1709. The authentication bypass flaw allowed attackers to compromise vulnerable systems and deploy malware.

ConnectWise disclosed another security incident in 2025 involving CVE-2025-3935, a high-severity ViewState code injection vulnerability. Suspected state-backed attackers used the flaw to access the cloud-hosted ScreenConnect instances of a limited number of customers.

In March 2026, the company also patched CVE-2026-3564. That cryptographic signature verification vulnerability could allow attackers to hijack unpatched ScreenConnect servers.

Since February 2024, CISA has added three ScreenConnect vulnerabilities to its Known Exploited Vulnerabilities catalogue. Attackers also used two of those flaws in ransomware campaigns.

The platform’s history makes the newly disclosed ScreenConnect flaw a priority for security teams. Organizations should deploy the temporary mitigation now and install the permanent patch as soon as ConnectWise releases it.