Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

ScreenConnect Remote Access file-transfer security flaw

Vulnerability
First reported
Last updated
Happening score
H score 44
1 unique sources, 2 articles

Summary

Hide ▲

The ScreenConnect Remote Access file-transfer vulnerability affects cloud and on-premises deployments and puts Support and Access sessions at risk. ConnectWise has not yet assigned a CVE and is relying on temporary mitigations while it prepares a permanent fix later this week. Administrators are being told to disable TransferFiles permissions to reduce exposure.

Related Happenings

ConnectWise ScreenConnect file-transfer mitigation advisory

Advisory/Mitigation
H score30 First: 07.09.2026 14:36 Last: 07.09.2026 14:36 Sources 1

About this happening: ConnectWise issued a ScreenConnect mitigation advisory after identifying an issue affecting file transfer behavior in Remote Access Support and Access sessions. Th...

Open Happening

ConnectWise ScreenConnect Remote Access file-transfer mitigation

Advisory/Mitigation
H score55 First: 07.09.2026 13:06 Last: 07.09.2026 13:06 Sources 1

How related: ConnectWise shared temporary mitigation measures for this missing-authorization flaw on September 7, advising security teams to disable TransferFiles permissions to block potential attacks.

About this happening: ConnectWise issued temporary mitigation steps for a ScreenConnect Remote Access file-transfer flaw affecting cloud and on-premises deployments. Administrators are...

Latest development: 16.09.2026 14:14

CISA says CVE-2026-84869 in ConnectWise ScreenConnect is being exploited in the wild, and added the flaw to its catalog of actively exploited vulnerabilities. The missing-authorization and improper privilege management issue can let an attacker transfer or execute files through active remote sessions without authorization or host confirmation, and ConnectWise issued temporary guidance on September 7 to disable TransferFiles permissions.

Open Happening

ConnectWise ScreenConnect remote access installation chain

Malware Activity
H score29 First: 05.08.2026 20:49 Last: 05.08.2026 20:49 Sources 1

About this happening: A malicious installer chain is now deploying ConnectWise ScreenConnect through a batch file and setup.msi, giving operators remote access to victim devices. The pa...

Open Happening

N-central authentication bypass authentication bypass flaw (multiple vulnerabilities)

Vulnerability
H score49 First: 03.08.2026 09:41 Last: 03.08.2026 09:41 Sources 1

About this happening: CVE-2026-18577 is an authentication-bypass vulnerability in N-able N-central that affects hosted and on-premises servers and was used in active exploitation be...

Latest development: 04.08.2026 10:00

CISA added CVE-2026-18577 in N-able N-central to its Known Exploited Vulnerabilities catalog after reports of active exploitation in the wild. The flaw is an incomplete patch for CVE-2026-18556 that can allow authentication bypass and account takeover in susceptible versions, and N-able said the issue is addressed in version 2026.3 HF1. Federal Civilian Executive Branch agencies were told to apply the fixes by August 6, 2026 and review N-central Take Control activity.

Open Happening

Progress ShareFile Storage Zone Controllers shutdown guidance

Advisory/Mitigation
H score44 First: 10.07.2026 19:26 Last: 10.07.2026 19:26 Sources 1

About this happening: Progress Software has told ShareFile customers using Storage Zone Controllers to shut down their servers immediately after detecting a credible external security...

Latest development: 14.07.2026 19:08

Progress Software identified a high-severity path traversal vulnerability affecting all 5.x and 6.x versions of ShareFile Storage Zone Controller, reserved a CVE identifier for it, and released versions 5.12.5 and 6.0.2 to patch the flaw and restore the controllers after updating. The company said it has no indication of unauthorized access to any ShareFile customer account or data and no active threat has been identified.

Open Happening

Timeline

  1. 16.09.2026 14:14 1 articles · 4d ago

    CISA says ScreenConnect flaw CVE-2026-84869 is actively exploited

    Exploitation Observed

    CISA says CVE-2026-84869 is being exploited in the wild against ConnectWise ScreenConnect, and ConnectWise shared temporary mitigations on September 7 that advise disabling TransferFiles permissions. The missing-authorization / improper privilege management flaw in ScreenConnect clients can let attackers with basic privileges transfer or execute files without user interaction, and Shadowserver says more than 1,000 instances remain unpatched and exposed online.

    Show sources
    Open in new tab
  2. 07.09.2026 13:06 2 articles · 13d ago

    ConnectWise issues temporary ScreenConnect file-transfer mitigations

    Mitigation Patch Update

    ConnectWise identified an issue affecting file transfer behavior in ScreenConnect Remote Access Support and Access sessions and told administrators to remove TransferFiles or TransferFilesInSession permissions from session roles while it prepares a permanent fix later this week. The issue affects cloud and on-premises deployments, has not yet been assigned a CVE, and Shadowserver tracks nearly 6,000 ScreenConnect instances exposed online.

    Show sources
    Open in new tab