ConnectWise Discloses Unpatched ScreenConnect File-Transfer Flaw, MSPs at Risk

ConnectWise issued a security advisory on September 3, 2026, for a new vulnerability in ScreenConnect Remote Access file transfer, with no software fix available. The company is developing an official patch slated for release within the week, but administrators must manually adjust role permissions in the meantime — a mitigation that degrades standard remote-support functionality. The exposure is structural: roughly 6,000 ScreenConnect instances are internet-exposed, according to Shadowserver data cited by BleepingComputer, and the platform has a documented history of rapid exploitation by ransomware groups.

"A CVE identifier and an official fix will be issued within the week" — ConnectWise, via HelpNetSecurity

The Flaw and Forced Mitigation

According to the advisory reported by BleepingComputer, ConnectWise "has identified an issue affecting the behavior of file transfer in ScreenConnect Remote Access Support and Access sessions." The defect affects both cloud-hosted and self-hosted deployments indiscriminately, expanding the attack surface across the entire installed base.

The temporary mitigation mandated by ConnectWise is purely configurational. Administrators must navigate to Administration > Security > Roles, edit each role, and deselect the TransferFiles permission under Scoped Permissions; for legacy versions, the permission to revoke is TransferFilesInSession. HelpNetSecurity quotes the company: "This setting change does not require a version upgrade and can be applied immediately."

The operational advantage — immediate applicability without a software update — comes with a functional cost: disabling file transfer blocks one of the core workflows of remote support, forcing teams to find alternative channels for data exchange with managed endpoints.

It does not indicate whether the flaw can be triggered by an authenticated user, a session guest, or from unauthenticated positions; nor does it document whether disabling TransferFiles alone eliminates the risk entirely or if alternative compromise paths remain.

The Exposure Count: 6,000 Visible Instances

Shadowserver data, cited by BleepingComputer and SecNews, indicates nearly 6,000 ScreenConnect instances are exposed on the internet. This figure may include honeypots or already-protected systems, as noted in the dossier, but retains indicative significance: ScreenConnect is one of the most widely deployed remote-access platforms among MSPs, and its network visibility amplifies the risk window between advisory and fix.

The platform has already gone through three cycles of addition to CISA's Known Exploited Vulnerabilities (KEV) catalog since February 2024, per BleepingComputer. This frequency establishes a pattern that makes the current patch gap particularly sensitive: threat actors have demonstrated rapid exploitation capability against previous ScreenConnect vulnerabilities, with documented impacts on MSP infrastructure and end customers.

CVE-2026-3564 Is a Separate Issue: The Risk of Conflation

A critical point of documentary clarity concerns the CVE identifier. The National Vulnerability Database (NVD) lists CVE-2026-3564 as a "cryptographic signature verification" vulnerability with a CVSS 3.1 score of 9.0 CRITICAL and vector AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, affecting all server versions prior to 26.1. This flaw, disclosed in March 2026, is technically distinct from the new file-transfer vulnerability.

The distinction is operationally relevant: vulnerability management systems and incident response teams tracking CVE-2026-3564 as an indicator of the new flaw would commit a classification error, delaying correct mitigation application or even identification of the actual risk. The lack of an assigned identifier for the current vulnerability complicates this scenario, creating a period of indeterminacy in security workflows.

Immediate Actions

• Immediately disable the TransferFiles permission (or TransferFilesInSession for legacy versions) in all ScreenConnect role Scoped Permissions, following the path Administration > Security > Roles
• Verify the change takes effect without requiring a service restart or version upgrade, and document its application across all managed cloud and on-premises instances
• Monitor for the official CVE assignment and patch from ConnectWise within the indicated week, preparing a priority rollout plan for internet-exposed instances
• Isolate any CVE-2026-3564 signals in risk assessment; it does not represent the current flaw but a prior vulnerability with a different mechanism and impact

A Recurring Pattern: Disclosure Without a Fix

The ConnectWise advisory fits into a sequence that concerns not just the vendor but the entire MSP ecosystem. The repetition of ScreenConnect vulnerabilities — authentication bypass in 2024, ViewState injection in 2025, cryptographic signature verification in March 2026, file transfer in September — forces providers into a response cadence that collides with operational continuity. Configurational mitigations, purely temporary by design, become structural when workflows depend on the very features they neutralize.

The question emerging from the dossier is not whether ConnectWise will release the patch, but when this vulnerability will be added to CISA's KEV catalog — and whether the window before that formalization will be sufficient for defenders. The platform's recent history suggests caution: threat actors have already shown they do not wait for the bureaucracy of cataloging.