Affected Systems
ConnectWise ScreenConnect Remote Access (all versions, both cloud and on-premises deployments). Approximately 6,000 instances exposed online. No CVE ID assigned yet. Affects file transfer behavior in Support and Access sessions.
Exploitation Status
No active exploitation reported yet. No CVE ID assigned. ConnectWise has disclosed the vulnerability proactively. Patch planned for later this week (as of September 7, 2026). Historical context: ScreenConnect vulnerabilities are frequently targeted by ransomware gangs and state-sponsored groups (e.g., Kimsuky APT, CVE-2024-1709 exploitation in 2024).
Business Impact
MSPs, IT departments, and support teams using ScreenConnect for remote access are at risk. The flaw affects file transfer functionality, a core feature for system maintenance and troubleshooting. Given ScreenConnect's history as a high-value target for ransomware and APT groups, and the large number of internet-exposed instances, this represents significant supply chain risk for MSPs managing multiple client environments. Temporary mitigation requires disabling file transfer permissions, which may disrupt operational workflows. CVSS score not yet published.
Urgency
🟠Within 24 hours
Recommended Actions
- Immediately disable TransferFiles permission (or TransferFilesInSession for legacy versions) for all user roles in ScreenConnect Administration > Security > Roles
- Audit all ScreenConnect session groups and verify file transfer permissions are removed across all roles
- Monitor ConnectWise security advisories for patch release expected later this week and apply immediately upon availability
- Review ScreenConnect access logs for unusual file transfer activity or unauthorized sessions prior to mitigation
- If ScreenConnect is internet-exposed, consider restricting access via firewall rules or VPN to trusted IP ranges until patched