ConnectWise has shared temporary mitigation measures for a new ScreenConnect Remote Access vulnerability that it plans to patch later this week.
ScreenConnect is an on-premises or cloud-hosted remote access platform typically used by managed service providers (MSPs), IT departments, and support teams for troubleshooting, patching, and system maintenance.
The security flaw affects both cloud and on-premises deployments, and it has not yet received a CVE ID for easy tracking.
“ConnectWise has identified an issue affecting file transfer behavior in ScreenConnect® Remote Access Support and Access sessions,” the company said in a security advisory issued on Thursday.
While ConnectWise is still working on a permanent fix for this security issue, it provided temporary mitigation steps designed to help block potential attacks.
This requires IT administrators to go through the following steps:
Internet security watchdog Shadowserver currently tracks nearly 6,000 ScreenConnect instances exposed online. However, there is no information regarding how many of these systems are honeyposts or have already been secured.
ScreenConnect vulnerabilities are often targeted in the wild by both financially-motivated and state-backed hacking groups.
For instance, in 2024, ransomware gangs and the Kimsuky North Korean APT hacking group exploited another ScreenConnect flaw (tracked as CVE-2024-1709) to drop malware on vulnerable systems.
Last year, ConnectWise disclosed that suspected state-sponsored hackers breached its systems via a high-severity ViewState code injection bug (CVE-2025-3935) and gained access to the cloud-based instances of a limited number of customers.
Earlier this year, in March, ConnectWise also addressed a ScreenConnect cryptographic signature verification vulnerability (tracked as CVE-2026-3564) that could allow attackers to hijack unpatched instances.
Since February 2024, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three ScreenConnect vulnerabilities to its catalog of actively exploited flaws, two of which were also abused in ransomware attacks.
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
Plex warns users to patch security vulnerabilities immediately
Hackers abuse Faronics Deploy admin tool to install ScreenConnect
Microsoft asks users to ignore ‘Antivirus is turned off’ errors
Hackers target Microsoft SharePoint RCE chain with PoC exploit
WhatsApp rolls out new feature that flags potential scam messages
New CrowdStrike ‘FalconFlank’ zero-day grants SYSTEM privileges
Google warns of new Chrome zero-day flaw exploited in attacks
IDScan sued over alleged data breach affecting 153 million drivers
Unify ransomware protection and recovery for every client
Can you trust every session? See how session enrichment enables better authentication decisions.
See how attackers exploit passkey enrollment, and why hardware-bound biometrics raise enterprise identity assurance.
Identity, Data Governance & Threat Detection in One Platform: Take our In-Browser Tour
Terms of Use – Privacy Policy – Ethics Statement – Affiliate Disclosure
Read our posting guidelinese to learn what content is prohibited.
