ConnectWise has warned customers of a newly discovered vulnerability in ScreenConnect, its widely-deployed remote access platform, that affects how file transfers behave during support and access sessions. The flaw has not yet been assigned a CVE identifier, and no patch is available yet — though ConnectWise says one is coming later this week. The issue affects both cloud-hosted and on-premises ScreenConnect deployments. Security monitoring firm Shadowserver currently tracks nearly 6,000 ScreenConnect instances directly reachable from the internet.
ScreenConnect is used by managed service providers, IT departments, and support teams to remotely access and troubleshoot systems. Its broad deployment and elevated access to managed endpoints have made it a repeated target: since February 2024, CISA has added three separate ScreenConnect vulnerabilities to its catalog of actively exploited flaws, two of which were subsequently used in ransomware attacks. The current flaw adds to that pattern, and ConnectWise is urging administrators to apply temporary mitigations immediately rather than wait for the patch.
How to check if you’re affected
Affected products include both cloud-hosted and on-premises ScreenConnect Remote Access Support and Access deployments — all current versions are affected until the patch is released. Administrators managing ScreenConnect should log in to the ScreenConnect Administration page, go to Administration → Security → Roles, and edit each user role. In the Scoped Permissions window, deselect the TransferFiles permission (or TransferFilesInSession for legacy installations) for every session group, then save changes. Repeat for all roles. This disables the vulnerable file-transfer capability as a temporary control until ConnectWise releases the permanent fix.
Organizations should also check their ScreenConnect event logs for any unusual file-transfer activity over the past several days, particularly from accounts or session types that would not normally initiate file transfers.