Full Report
ConnectWise has shared temporary mitigation measures for a new ScreenConnect Remote Access vulnerability that it plans to patch later this week. [...]
Analysis Summary
# Vulnerability: ConnectWise ScreenConnect File Transfer Unauthorized Access
## CVE Details
- **CVE ID:** Pending (Not yet assigned)
- **CVSS Score:** Not yet rated (Likely High/Critical based on historical context)
- **CWE:** Likely related to Improper Authorization or Improper Access Control (focused on file transfer behavior).
## Affected Systems
- **Products:** ScreenConnect (also known as ConnectWise Control) Remote Access Support and Access sessions.
- **Versions:** Affects both Cloud and On-premises deployments. Specific version numbers are not yet detailed, but all current versions should be considered vulnerable until the patch is released.
- **Configurations:** Systems where "TransferFiles" or "TransferFilesInSession" permissions are enabled for user roles.
## Vulnerability Description
ConnectWise has identified a security flaw affecting the file transfer behavior within ScreenConnect sessions. While full technical details are currently restricted to prevent widespread exploitation before a patch is available, the flaw allows for unauthorized or unintended file transfers, which could be leveraged to drop malicious payloads or exfiltrate data from managed endpoints.
## Exploitation
- **Status:** Not explicitly reported as exploited in the wild, but the vendor has issued an urgent advisory ahead of a patch, indicating a high risk of imminent exploitation.
- **Complexity:** Low (Based on previous ScreenConnect flaws and the nature of the workaround).
- **Attack Vector:** Network.
## Impact
- **Confidentiality:** High (Risk of data exfiltration).
- **Integrity:** High (Risk of unauthorized file placement/malware deployment).
- **Availability:** Medium (Potential for system disruption via malicious file execution).
## Remediation
### Patches
- **Status:** No patch currently available. ConnectWise plans to release a permanent fix later this week (scheduled for the week of September 7, 2026).
### Workarounds
Administrators are advised to manually disable file transfer permissions immediately:
1. Log in to the **ScreenConnect Administration** page.
2. Navigate to **Administration > Security > Roles**.
3. Edit each user role and inspect **Session Groups**.
4. In the **Scoped Permissions** window, deselect **TransferFiles** (or **TransferFilesInSession** for legacy versions).
5. Save changes and repeat for all roles.
## Detection
- **Indicators of Compromise:** Monitor ScreenConnect logs for unusual file transfer activity, particularly transfers initiated by accounts that do not typically perform such actions or transfers to/from suspicious directory paths (e.g., `C:\Windows\Temp` or `AppData`).
- **Detection methods and tools:** Audit user roles and permissions to ensure the workaround is applied. Use network monitoring to detect large or unusual outbound/inbound data transfers associated with the ScreenConnect process.
## References
- **Vendor Advisory:** hxxps[://]www[.]connectwise[.]com/company/trust/advisories
- **Shadowserver Statistics:** hxxps[://]dashboard[.]shadowserver[.]org/statistics/iot-devices/time-series/?date_range=180&vendor=connectwise&model=screenconnect
- **Historical Context (CVE-2024-1709):** hxxp[://]nvd[.]nist[.]gov/vuln/detail/CVE-2024-1709