As reported by BleepingComputer, ConnectWise has disclosed a new, unpatched vulnerability in its ScreenConnect Remote Access platform affecting file transfer behavior in both cloud-hosted and on-premises deployments. No CVE identifier has been assigned yet, and a permanent patch is expected later this week. In the interim, ConnectWise has published temporary mitigation steps involving the restriction of the TransferFiles permission across user roles.
Why This Matters
ScreenConnect occupies a privileged position in many enterprise and MSP environments — it is the tool technicians use to access, troubleshoot, and administer endpoints across entire client fleets. A vulnerability in file transfer functionality is not a minor issue; it represents a potential bidirectional data exfiltration and payload delivery path into thousands of managed environments simultaneously.
According to Shadowserver data cited in the report, nearly 6,000 ScreenConnect instances are currently internet-exposed. Even if a fraction of those are honeypots or already secured, the attack surface is substantial. More critically, ScreenConnect has a documented history of being actively exploited by both financially motivated criminals and state-sponsored actors — including ransomware gangs and the North Korean Kimsuky APT group, who abused CVE-2024-1709 in 2024 to deliver malware.
Prior ScreenConnect Vulnerabilities of Note
| CVE | Description | Exploitation |
|---|---|---|
| CVE-2024-1709 | Authentication bypass | Active exploitation by ransomware operators and Kimsuky APT |
| CVE-2025-3935 | ViewState code injection | Suspected state-sponsored breach of ConnectWise systems |
| CVE-2026-3564 | Cryptographic signature verification flaw | Could allow instance hijacking; patched March 2026 |
CISA has added three ScreenConnect vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog since February 2024, two of which were linked to ransomware campaigns. This pattern underscores that ScreenConnect is not a theoretical target — it is a preferred initial access vector for threat actors who understand that compromising a single MSP platform can cascade into hundreds of downstream victim organizations.
Who Is at Risk
TransferFiles is granted broadly across session groupsImmediate Actions
- Apply temporary mitigation now: Log into the ScreenConnect Administration page, navigate to Administration > Security > Roles, and deselect the
TransferFiles(orTransferFilesInSessionfor legacy versions) permission for every session group across all roles. Save and repeat systematically. - Audit role configurations: Review all user and group role assignments to identify any accounts with unnecessary file transfer privileges. This is also an opportunity to enforce least-privilege across the board.
- Reduce internet exposure: If your ScreenConnect instance does not require public-facing access, place it behind a VPN, zero-trust network access layer, or restrict access via IP allowlisting at the firewall.
- Monitor for indicators of abuse: Review session logs for unusual file transfer activity, unexpected session initiation from non-standard geographic locations, or authentication anomalies.
- Patch immediately when released: ConnectWise has indicated a permanent fix is coming this week. Treat deployment as an emergency change and prioritize it across all instances.
Shield53 Note: This vulnerability lacks a CVE identifier and CVSS score at present, which complicates asset management and risk-scoring workflows. Security teams should track this manually in their vulnerability management platforms and flag it internally as Critical pending formal classification — given the platform's access level and exploitation history, the risk profile warrants maximum urgency.
Broader Implications
This disclosure reinforces a uncomfortable truth about remote access tools: they are simultaneously the most useful and most dangerous software in an IT environment. Every remote access session is a potential attacker's session if the platform is vulnerable. Organizations should be asking whether their remote support tools need to be internet-facing at all, and whether the blast radius of a compromise has been properly modeled.
Furthermore, the delay between disclosure and patch availability — while ConnectWise is being transparent — creates a window where defenders must rely solely on configuration changes and network-level controls. This is exactly the scenario where exposure management platforms and attack surface intelligence become critical for prioritizing response.
