ScreenConnect Remote Access file-transfer security flaw
Vulnerability
Summary
Hide ▲
Show ▼
The ScreenConnect Remote Access file-transfer vulnerability affects cloud and on-premises deployments and puts Support and Access sessions at risk. ConnectWise has not yet assigned a CVE and is relying on temporary mitigations while it prepares a permanent fix later this week. Administrators are being told to disable TransferFiles permissions to reduce exposure.
Related Happenings
ConnectWise ScreenConnect Remote Access file-transfer mitigation
Advisory/Mitigation
H score57
First: 07.09.2026 13:06
Last: 07.09.2026 13:06
Sources 1
How related:
While ConnectWise is still working on a permanent fix for this security issue, it provided temporary mitigation steps designed to help block potential attacks.
About this happening:
ConnectWise issued temporary mitigation steps for a ScreenConnect Remote Access file-transfer flaw affecting cloud and on-premises deployments. Administrators are...
ConnectWise ScreenConnect Remote Access file-transfer mitigation
Advisory/MitigationHow related: While ConnectWise is still working on a permanent fix for this security issue, it provided temporary mitigation steps designed to help block potential attacks.
About this happening: ConnectWise issued temporary mitigation steps for a ScreenConnect Remote Access file-transfer flaw affecting cloud and on-premises deployments. Administrators are...
ConnectWise ScreenConnect remote access installation chain
Malware Activity
H score29
First: 05.08.2026 20:49
Last: 05.08.2026 20:49
Sources 1
About this happening:
A malicious installer chain is now deploying ConnectWise ScreenConnect through a batch file and setup.msi, giving operators remote access to victim devices. The pa...
ConnectWise ScreenConnect remote access installation chain
Malware ActivityAbout this happening: A malicious installer chain is now deploying ConnectWise ScreenConnect through a batch file and setup.msi, giving operators remote access to victim devices. The pa...
Storm-1175 high-velocity zero-day and N-day intrusion campaign
Campaign
H score44
First: 07.04.2026 09:35
Last: 07.04.2026 09:35
Sources 1
About this happening:
Storm-1175 is running a high-velocity intrusion campaign that chains zero-day and N-day vulnerabilities to gain initial access to exposed systems, raising the risk...
Storm-1175 high-velocity zero-day and N-day intrusion campaign
CampaignAbout this happening: Storm-1175 is running a high-velocity intrusion campaign that chains zero-day and N-day vulnerabilities to gain initial access to exposed systems, raising the risk...
ScreenConnect cryptographic signature verification vulnerability (CVE-2026-3564)
Vulnerability
H score26
First: 18.03.2026 20:10
Last: 18.03.2026 20:10
Sources 1
About this happening:
ConnectWise disclosed CVE-2026-3564, a cryptographic signature verification vulnerability in ScreenConnect that can enable unauthorized access and privilege esca...
ScreenConnect cryptographic signature verification vulnerability (CVE-2026-3564)
VulnerabilityAbout this happening: ConnectWise disclosed CVE-2026-3564, a cryptographic signature verification vulnerability in ScreenConnect that can enable unauthorized access and privilege esca...
Timeline
-
07.09.2026 13:06 2 articles · 0h ago
ConnectWise issues temporary ScreenConnect file-transfer mitigations
Mitigation Patch UpdateConnectWise identified an issue affecting file transfer behavior in ScreenConnect Remote Access Support and Access sessions and told administrators to remove TransferFiles or TransferFilesInSession permissions from session roles while it prepares a permanent fix later this week. The issue affects cloud and on-premises deployments, has not yet been assigned a CVE, and Shadowserver tracks nearly 6,000 ScreenConnect instances exposed online.
Show sources
- ConnectWise warns of new ScreenConnect flaw without patch — www.bleepingcomputer.com — 07.09.2026 13:06
- ConnectWise warns of new ScreenConnect flaw without patch — www.bleepingcomputer.com — 07.09.2026 13:06