ConnectWise has shared temporary mitigation measures for a new ScreenConnect Remote Access vulnerability that it plans to patch later this week.
ScreenConnect is an on-premises or cloud-hosted remote access platform typically used by managed service providers (MSPs), IT departments, and support teams for troubleshooting, patching, and system maintenance.
The security flaw affects both cloud and on-premises deployments, and it has not yet received a CVE ID for easy tracking.
“ConnectWise has identified an issue affecting file transfer behavior in ScreenConnect® Remote Access Support and Access sessions,” the company said in a security advisory issued on Thursday.
While ConnectWise is still working on a permanent fix for this security issue, it provided temporary mitigation steps designed to help block potential attacks.
This requires IT administrators to go through the following steps:
- Log in to the ScreenConnect Administration page.
- Go to Administration > Security > Roles.
- Edit user roles and check session groups (in bold)with permissions assigned to them.
- In the Scoped Permissions window, deselect the TransferFiles permission (or TransferFilesInSession for legacy) for each session group.
- Save changes and repeat for all roles.
Internet security watchdog Shadowserver currently tracks nearly 6,000 ScreenConnect instances exposed online. However, there is no information regarding how many of these systems are honeyposts or have already been secured.
​ScreenConnect vulnerabilities are often targeted in the wild by both financially-motivated and state-backed hacking groups.
For instance, in 2024, ransomware gangs and the Kimsuky North Korean APT hacking group exploited another ScreenConnect flaw (tracked as CVE-2024-1709) to drop malware on vulnerable systems.
Last year, ConnectWise disclosed that suspected state-sponsored hackers breached its systems via a high-severity ViewState code injection bug (CVE-2025-3935) and gained access to the cloud-based instances of a limited number of customers.
Earlier this year, in March, ConnectWise also addressed a ScreenConnect cryptographic signature verification vulnerability (tracked as CVE-2026-3564) that could allow attackers to hijack unpatched instances.
Since February 2024, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three ScreenConnect vulnerabilities to its catalog of actively exploited flaws, two of which were also abused in ransomware attacks.
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
