"ConnectWise has identified an issue affecting file transfer behavior in ScreenConnect Remote Access Support and Access sessions" is the entire technical description on offer [2]. As reported by BleepingComputer, the advisory does not state whether the flaw is reachable without authentication, what a successful attacker obtains, or whether anyone has used it [11]. The advisory carries no CVE [3], and it lacks the kind of indicator that would let an administrator go back through last month's session logs and check [11].
So the mitigation is a permissions change made by hand. Administrators open the ScreenConnect Administration page, go to Administration > Security > Roles, and deselect TransferFiles, or TransferFilesInSession on legacy builds, for every session group in the Scoped Permissions window of every role [5]. The work scales with roles multiplied by session groups. Because ConnectWise calls the step temporary and expects to ship a fix in the same week, each of those toggles gets touched twice: cleared now, restored after the patch [13].
Shadowserver's count of nearly 6,000 exposed instances is a ceiling on internet-reachable consoles rather than a count of affected ones, since the split between honeypots and already-secured hosts is not published [6][14]. On-premises operators set their own patch timing, but cloud tenants get the code fix on ConnectWise's schedule, which leaves the role edit as the only control they hold this week [15].
The reason an undescribed file-transfer bug in this product still warrants the role edits is the run of exploitation behind it. ConnectWise's platform is regularly targeted by both financially motivated and state-backed groups [16]. CVE-2024-1709 was used in 2024 by ransomware gangs and by the North Korean group Kimsuky to drop malware [7]. CVE-2025-3935, a ViewState code injection bug, was the route suspected state-sponsored intruders took into ConnectWise itself, reaching the cloud instances of a limited number of customers [8]. March brought CVE-2026-3564, a cryptographic signature verification flaw that allowed hijacking of unpatched instances [9]. Three ScreenConnect bugs have entered CISA's actively exploited catalog since February 2024, two of them also used in ransomware [10], which across the 25 months to that March fix averages one listing every eight months [12].
The patch date is what decides the cost here. If ConnectWise ships when it said it would, stripping TransferFiles from exposed instances buys a few days of technicians moving files some other way. If the date slips, the consoles still offering the feature are offering the one the vendor singled out, and no log will settle afterwards whether it was used [11].
