ConnectWise Warns of New ScreenConnect Flaw — No Patch Yet

ConnectWise has disclosed a new vulnerability in its ScreenConnect remote access platform and published temporary mitigations. The developers plan to release a permanent fix later this week.

ScreenConnect is a remote access platform that can be deployed both on-premises and in the cloud. It is typically used by managed service providers (MSPs), IT departments and help desks to troubleshoot, install updates and maintain systems. The new vulnerability affects both cloud and on-premises deployments and has not yet been assigned a CVE identifier, which makes the issue harder to track.

According to the company, the problem is tied to file-transfer behavior in ScreenConnect Remote Access Support and Access sessions. Until a permanent patch is ready, ConnectWise is offering administrators a temporary workaround.

Temporary Mitigations

Administrators are advised to log in to the ScreenConnect administration panel and go to Administration > Security > Roles. From there, edit the custom roles, review the session groups and the permissions assigned to them, and in the Scoped Permissions window clear the TransferFiles permission (or TransferFilesInSession for legacy configurations) for each session group. The changes should be saved and repeated for every role.

Scale and Background

Shadowserver, an organization that monitors internet security, counts roughly 6,000 ScreenConnect instances reachable from the network. It is unclear, however, how many of these are honeypots and how many are already protected.

ScreenConnect vulnerabilities are regularly targeted by both financially motivated groups and state-sponsored hackers. In 2024, ransomware operators and the North Korean APT group Kimsuky exploited the CVE-2024-1709 vulnerability to deliver malware. Last year, ConnectWise acknowledged that presumed state-backed hackers had breached its systems through a ViewState code-injection vulnerability (CVE-2025-3935) and gained access to the cloud instances of a limited number of customers. In March of this year, the company patched a cryptographic signature verification vulnerability (CVE-2026-3564) that allowed unpatched systems to be taken over.

Since February 2024, the U.S. agency CISA has added three ScreenConnect flaws to its catalog of actively exploited vulnerabilities, two of which were used in ransomware attacks.

Source: Bleeping Computer