Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

ConnectWise ScreenConnect Remote Access file-transfer mitigation

Advisory/Mitigation
First reported
Last updated
Happening score
H score 55
1 unique sources, 2 articles

Summary

Hide ▲

ConnectWise issued temporary mitigation steps for a ScreenConnect Remote Access file-transfer flaw affecting cloud and on-premises deployments. Administrators are told to remove the TransferFiles permission, or TransferFilesInSession on legacy setups, to reduce attack exposure. The issue has no CVE yet, so the advisory is the main protection until the permanent fix later this week.

Related Happenings

CISA mitigation guidance for CISA Adds Cisco Secure FMC CVE-2026-20079 to KEV Sets Sept. 12 Deadline

Advisory/Mitigation
H score58 First: 10.09.2026 00:40 Last: 10.09.2026 00:40 Sources 1

About this happening: CISA added CVE-2026-20079 to the KEV catalog and ordered Federal Civilian Executive Branch (FCEB) agencies to patch affected Cisco Secure FMC systems by Sept...

Open Happening

ConnectWise ScreenConnect file-transfer mitigation advisory

Advisory/Mitigation
H score30 First: 07.09.2026 14:36 Last: 07.09.2026 14:36 Sources 1

About this happening: ConnectWise issued a ScreenConnect mitigation advisory after identifying an issue affecting file transfer behavior in Remote Access Support and Access sessions. Th...

Open Happening

ScreenConnect Remote Access file-transfer security flaw

Vulnerability
H score44 First: 07.09.2026 13:06 Last: 07.09.2026 13:06 Sources 1

How related: The vulnerability (now tracked as CVE-2026-84869 and patched in ScreenConnect 26.6.5 and later) affects ScreenConnect clients and can let threat actors with basic privileges transfer or execute files in low-complexity attacks that don't require user interaction.

About this happening: The ScreenConnect Remote Access file-transfer vulnerability affects cloud and on-premises deployments and puts Support and Access sessions at risk. ConnectWise has...

Latest development: 16.09.2026 14:14

CISA says CVE-2026-84869 is being exploited in the wild against ConnectWise ScreenConnect, and ConnectWise shared temporary mitigations on September 7 that advise disabling TransferFiles permissions. The missing-authorization / improper privilege management flaw in ScreenConnect clients can let attackers with basic privileges transfer or execute files without user interaction, and Shadowserver says more than 1,000 instances remain unpatched and exposed online.

Open Happening

Citrix NetScaler ADC/Gateway memory overflow flaw (CVE-2026-8452)

Vulnerability
H score34 First: 27.08.2026 12:16 Last: 27.08.2026 12:16 Sources 1

About this happening: CVE-2026-8452 is an actively exploited memory overflow flaw in Citrix NetScaler ADC and NetScaler Gateway appliances, including systems configured with Gateway V...

Open Happening

N-central authentication bypass authentication bypass flaw (multiple vulnerabilities)

Vulnerability
H score49 First: 03.08.2026 09:41 Last: 03.08.2026 09:41 Sources 1

About this happening: CVE-2026-18577 is an authentication-bypass vulnerability in N-able N-central that affects hosted and on-premises servers and was used in active exploitation be...

Latest development: 04.08.2026 10:00

CISA added CVE-2026-18577 in N-able N-central to its Known Exploited Vulnerabilities catalog after reports of active exploitation in the wild. The flaw is an incomplete patch for CVE-2026-18556 that can allow authentication bypass and account takeover in susceptible versions, and N-able said the issue is addressed in version 2026.3 HF1. Federal Civilian Executive Branch agencies were told to apply the fixes by August 6, 2026 and review N-central Take Control activity.

Open Happening

Timeline

  1. 16.09.2026 14:14 1 articles · 4d ago

    CISA says ScreenConnect flaw is exploited in the wild

    Exploitation Observed

    CISA says CVE-2026-84869 in ConnectWise ScreenConnect is being exploited in the wild, and added the flaw to its catalog of actively exploited vulnerabilities. The missing-authorization and improper privilege management issue can let an attacker transfer or execute files through active remote sessions without authorization or host confirmation, and ConnectWise issued temporary guidance on September 7 to disable TransferFiles permissions.

    Show sources
    Open in new tab
  2. 07.09.2026 13:06 2 articles · 13d ago

    ConnectWise issues temporary mitigation for ScreenConnect file-transfer flaw

    Mitigation Patch Update

    ConnectWise identified an issue affecting file transfer behavior in ScreenConnect Remote Access Support and Access sessions and provided temporary mitigation steps while it works on a permanent fix. Administrators are told to remove the TransferFiles permission, or TransferFilesInSession for legacy setups, from session groups across cloud and on-premises deployments. The company said the permanent fix is planned later this week, and Shadowserver said nearly 6,000 ScreenConnect instances are exposed online.

    Show sources
    Open in new tab