ConnectWise warns of new ScreenConnect flaw without patch

ConnectWise has shared temporary mitigation measures for a new ScreenConnect Remote Access vulnerability that it plans to patch later this week. ScreenConnect is an on-premises or cloud-hosted remote access platform typically used by managed service providers (MSPs), IT departments, and support teams for troubleshooting, patching, and system maintenance. The security flaw affects both cloud and on-premises deployments, and it has not yet received a CVE ID for easy tracking. "ConnectWise has identified an issue affecting file transfer behavior in ScreenConnect® Remote Access Support and Access sessions," the company said in a security advisory issued on Thursday. While ConnectWise is still working on a permanent fix for this security issue, it provided temporary mitigation steps designed to help block potential attacks. This requires IT administrators to go through the following steps: Internet security watchdog Shadowserver currently tracks nearly 6,000 ScreenConnect instances exposed online. However, there is no information regarding how many of these systems are honeyposts or have already been secured. ​ScreenConnect vulnerabilities are often targeted in the wild by both financially-motivated and state-backed hacking groups. For instance, in 2024, ransomware gangs and the Kimsuky North Korean APT hacking group exploited another ScreenConnect flaw (tracked as CVE-2024-1709) to drop malware on vulnerable systems. Last year, ConnectWise disclosed that suspected state-sponsore...