ConnectWise Warns of ScreenConnect Guest File Transfer Flaw Affecting Cloud and On-Premise Systems

ConnectWise has issued a security advisory regarding an undisclosed file-transfer issue in ScreenConnect Remote Access affecting both cloud-hosted and on-premises deployments.

The flaw impacts ScreenConnect Remote Access Support and Access sessions, potentially exposing organizations to risk through the platform’s technician file-transfer capability.

ConnectWise said it is developing a permanent fix and will assign a CVE identifier after its cloud-environment rollout.

ConnectWise Warns of ScreenConnect Guest File Transfer Flaw

While technical details of the vulnerability, including its root cause, attack requirements, impact severity, and potential exploitation scenarios, have not yet been disclosed, the company has released an immediate mitigation: administrators should remove file-transfer permissions from technician roles.

According to the September 3, 2026 advisory, the issue concerns file-transfer behavior in ScreenConnect Remote Access sessions rather than a single deployment model or product version.

ScreenConnect, previously known as ConnectWise Control, is widely used by managed service providers (MSPs) and enterprise IT teams to remotely access endpoints, support users, and administer systems.

Because remote-management platforms commonly hold privileged access across multiple customer environments, weaknesses involving authentication, session access, or file movement can have outsized security implications.

The advisory follows a period of heightened attention on remote-access software, particularly after threat actors have repeatedly targeted MSP tooling and remote-management products to gain broad access to downstream customer networks.

ConnectWise advised partners to immediately disable technician file-transfer permissions while it prepares the official patch. The setting can be changed without upgrading ScreenConnect.

Administrators should:

1. Sign in to the Administration page of their ScreenConnect instance or installation.
2. Navigate to Administration > Security > Roles.
3. Edit every role assigned to ScreenConnect users.
4. Review each session group with assigned permissions, identified in bold text.
5. Check whether the TransferFiles permission is enabled in the Scoped Permissions window.
6. For legacy versions, check for TransferFilesInSession.
7. Remove the applicable file-transfer permission and save the role.
8. Repeat the process for every defined role.

Disabling the feature may affect normal technician workflows, including transferring diagnostic tools, scripts, logs, software packages, and remediation files during remote-support sessions.

However, organizations should weigh that operational disruption against the potential risk until ConnectWise provides a verified fix.

ConnectWise said it plans to publish a CVE identifier once its cloud environments have been updated. The company also expects to release a patched version that addresses the underlying behavior and update its advisory with further remediation guidance.

Organizations using ScreenConnect should inventory both cloud and self-hosted instances, identify roles with file-transfer rights, apply the interim mitigation, and monitor ConnectWise’s advisory page for the patch and CVE details.

Security teams should also review ScreenConnect administrative activity and recent file-transfer events for unusual behavior, particularly in environments where technicians have broad access to customer systems.

Give your security team the visibility and context to investigate suspicious activity faster and contain threats before business impact grows. Strengthen Your Investigations with ANY.RUN

The post ConnectWise Warns of ScreenConnect Guest File Transfer Flaw Affecting Cloud and On-Premise Systems appeared first on Cyber Security News.