ScreenConnect Instance Level Cryptographic Material Exposure
Priority MEDIUM 41CWE-347Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-347.
Summary
A condition in the ScreenConnect server component may allow an actor with access to server-level cryptographic material used for authentication to obtain unauthorized access, including elevated privileges, in certain scenarios. ScreenConnect host and guest client agents are not independently affected by this CVE.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00377 31st percentileScored 2026-11-07
Fix Fixed ScreenConnect (ConnectWise): 26.1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ConnectWise | ScreenConnect | before 26.1 | 26.1 | Patch available | CNA |
- ScreenConnect VendorConnectWise Affected before 26.1 Fixed in 26.1 Patch available CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:connectwise:screenconnect:*:*:*:*:*:*:*:* | — | — | ConnectWise |
- cpe:2.3:a:connectwise:screenconnect:*:*:*:*:*:*:*:* Versions — — ·ConnectWise
Remediation
- Fix · CNA ScreenConnect (ConnectWise) Fixed in 26.1
Timeline
- 2026-10-02 Threatist record created from CVE-2026-3564
- 2026-10-03 Alias added: GHSA-hrc2-hchg-rq8r
References
More ConnectWise vulnerabilities
- TI-2026-58346 ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions KEVCVSS 3.1CRITICAL 9.9
- TI-2024-01589 Authentication bypass using an alternate path or channel KEVCVSS 3.1CRITICAL 10.0
- TI-2017-13536 ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to… KEVCVSS 3.1CRITICAL 9.8
- TI-2024-01588 Improper limitation of a pathname to a restricted directory (“path traversal”) KEVCVSS 3.1HIGH 8.4
- TI-2025-03479 ScreenConnect Exposure to ASP.NET ViewState Code Injection KEVCVSS 3.1HIGH 8.1
- TI-2023-10995 ConnectWise Control before 22.9.10032 (formerly known as ScreenConnect) fails to validate… CVSS 3.1HIGH 8.8
Sources
- CVE-2026-3564 · CVE Program
- CVE-2026-3564 · NVD
- FIRST EPSS
- GHSA-hrc2-hchg-rq8r · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences