In early September 2026, ConnectWise issued an advisory about a new flaw in ScreenConnect, its remote access tool, before a fix was available. BleepingComputer reported on September 7 that the issue involves file transfer behavior in support and access sessions and affects both cloud and on-premises deployments. The flaw had no CVE ID at the time, and ConnectWise said it planned to patch later that week.
ScreenConnect is one of the most common tools MSPs and internal IT teams use to reach user computers. The report noted that Shadowserver tracks nearly 6,000 internet-exposed ScreenConnect instances and that earlier ScreenConnect flaws were exploited by ransomware groups and state-backed actors. No exploitation of this specific flaw had been confirmed.
ConnectWise's interim mitigation was to remove the file-transfer permission from every session group in every role: in the Administration page, under Security and Roles, deselect TransferFiles (or TransferFilesInSession on older versions) in Scoped Permissions. If your provider uses ScreenConnect, ask whether they applied that workaround, whether they have since installed the patch, and whether their server is cloud-hosted or on-premises. On-premises servers typically depend on the provider to apply updates.
ScreenConnect has needed several security fixes in recent releases, including a critical flaw (CVE-2026-3564) fixed in version 26.1. Ask your provider how quickly they apply ScreenConnect updates and how they would notify you of an issue that affects your systems.
Sources
Vendor in this insight
ConnectWise
The most comprehensive MSP platform suite — PSA (Professional Services Automation), RMM, security, quoting, and billing from a single vendor. Tampa, Florida; private, owned by Thoma Bravo. ConnectWise Manage (PSA) is the dominant ticketing, billing, and project management platform for MSPs. ConnectWise Automate (RMM) provides scripting-heavy automation favored by larger MSPs. ConnectWise Fortify adds integrated security operations. Used by 45,000+ MSP partners managing over 5M endpoints. The most established MSP toolset competing with Kaseya, Datto/Kaseya, and NinjaOne.
View vendor profileDoes this affect your business?
Our advisors can help you figure out the right move, at no cost.