ConnectWise flags ScreenConnect file transfer flaw

ConnectWise issued a ScreenConnect security advisory on Thursday, 3 September 2026. BleepingComputer quotes the company: it "has identified an issue affecting file transfer behavior in ScreenConnect Remote Access Support and Access sessions." The issue covers both cloud-hosted and on-premises deployments. ConnectWise said a CVE identifier and an official fix will be issued within the week, a calendar that can move.

The temporary mitigation needs no version upgrade. In Administration > Security > Roles, deselect TransferFiles (or TransferFilesInSession on legacy builds) for technician roles, for each session group. Help Net Security reports ConnectWise's wording that the change can be applied immediately, and that administrators must repeat it for every applicable role.

Help Net also carries Huntress guidance: give extra scrutiny to on-premises installs, and check audit logs for RunFiles or RanFiles tied to a guest process. Reimage compromised hosts from known-good media. A 7 September Help Net update says ConnectWise has not confirmed a technical link between this file transfer flaw and the rogue-client worm Huntress described. The two tracks stay separate until a vendor note ties them.

Shadowserver, via BleepingComputer, tracks nearly 6,000 ScreenConnect instances exposed online. How many of those are honeypots is not broken out. Prior ScreenConnect abuse, including the 2024 CVE-2024-1709 wave, is background on the product, not proof of a nation-state campaign for this advisory.

Some offers on this page may be paid placements or contain affiliate links.