ConnectWise ScreenConnect Hit by New File-Transfer Flaw, Patch Days Away

Key points

• ConnectWise disclosed a new flaw in ScreenConnect on Thursday affecting file transfer in Remote Access and Support sessions, with a patch expected later in the week.
• The bug has no CVE identifier yet and hits both cloud and on-premises installations.
• Nearly 6,000 ScreenConnect servers sit exposed on the public internet, according to scans by the Shadowserver Foundation.
• ConnectWise's workaround tells administrators to strip the TransferFiles permission from user roles until the fix lands.
• Past ScreenConnect bugs have been used by ransomware crews and North Korea's Kimsuky group, and three sit on the U.S. Government's known-exploited list.

ConnectWise is telling customers to disable file transfers inside its ScreenConnect remote-support tool while it finishes work on a patch due later this week.

ScreenConnect, sold to managed service providers and corporate IT teams, lets a technician take control of a distant computer to fix problems or move files. It runs either in ConnectWise's cloud or on a customer's own server. Both setups are affected.

The company published a security advisory on Thursday describing "an issue affecting file transfer behavior" in active sessions. No CVE tracking number has been assigned, and ConnectWise hasn't said whether anyone is exploiting the bug yet.

First reported by BleepingComputer, the disclosure is short on technical detail. What ConnectWise did publish is a workaround.

What should IT teams do right now?

Strip file-transfer rights from every ScreenConnect role until the patch arrives. Log into the ScreenConnect Administration page, open Administration then Security, edit each role, and untick the TransferFiles permission (called TransferFilesInSession on older builds) inside Scoped Permissions. Save, then repeat for every role. Technicians can still open remote sessions. They just won't be able to push or pull files through them.

How exposed is the wider internet?

The Shadowserver Foundation, a non-profit that scans the internet for exposed systems, currently sees nearly 6,000 ScreenConnect servers reachable from the public internet. Not all are vulnerable, and some will be honeypots (decoy systems set up by researchers to bait attackers). The number is still a fair proxy for how much attack surface is out there.

Why does this product keep getting attacked?

Remote-support software is a shortcut into everything a company owns. Break one ScreenConnect server and you can potentially reach every machine it manages, which is why criminal and government hackers keep targeting it.

In 2024, ransomware gangs and North Korea's Kimsuky group exploited CVE-2024-1709, an authentication bypass that let anyone create an admin account on an unpatched server. ConnectWise later disclosed that suspected state-backed hackers breached its systems through a ViewState code injection bug, CVE-2025-3935, gaining access to cloud instances of a limited number of customers. A cryptographic signature bug patched in March, tracked as CVE-2025-3564, added to the run.

CISA has added three ScreenConnect flaws to its Known Exploited Vulnerabilities catalogue since February 2024, two of which were used in ransomware campaigns. We've followed ScreenConnect's abuse as a delivery mechanism separately: on 1 September, phishing crews enrolled more than 450 victim PCs into a management tool before installing ScreenConnect for hands-on remote control.

Recent ScreenConnect security history

Should ordinary customers be worried?

If your employer or IT provider uses ScreenConnect to support your machine, the fix is on their side, not yours. Watch for support sessions you didn't request, and put the phone down on anyone who cold-calls claiming to be from IT and asks you to approve a remote connection. This week, that basic caution matters more than usual.