Critical severity · published Mar 17, 2026
CVE-2026-3564
ScreenConnect Instance Level Cryptographic Material Exposure
9.0
CVSS
0.4%
EPSS
No
On KEV
Description
A condition in the ScreenConnect server component may allow an actor with access to server-level cryptographic material used for authentication to obtain unauthorized access, including elevated privileges, in certain scenarios. ScreenConnect host and guest client agents are not independently affected by this CVE.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SC
ScreenConnect · ConnectWise
All server versions prior to 26.1 · source: vendor
In the news
VulnerabilityCritical
Unpatched ScreenConnect servers open to attack (CVE-2026-3564)
ConnectWise has patched a critical vulnerability (CVE-2026-3564) that could enable attackers to hijack ScreenConnect sessions by abusing ASP.NET machine keys to forge trusted authentication. About CVE-2026-3564 The ScreenConnect remote access platform is popular with managed service providers, IT departments, and technology solution providers. They can opt for the cloud-hosted version or can deploy it on their own servers or in their private cloud. CVE-2026-3564 stems from improper verification of cryptographic signature, can be exploited remotely … More →
The post Unpatched ScreenConnect servers open to attack (CVE-2026-3564) appeared first on Help Net Security .
Mar 20, 2026·Help Net Security
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-3564
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-3564
www.connectwise.com
https://www.connectwise.com/company/trust/security-bulletins/2026-03-17-screenconnect-bulletin
More from ScreenConnect
10.0
CVE-2024-1709
Authentication bypass using an alternate path or channel
9.9
CVE-2026-84869
ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions
8.4
CVE-2024-1708
Improper limitation of a pathname to a restricted directory (“path traversal”)
7.2
CVE-2025-3935
ScreenConnect Exposure to ASP.NET ViewState Code Injection
9.8
CVE-2023-25718
In ConnectWise Control through 22.9.10032 (formerly known as ScreenConnect), after an executable file is signed, additional instructions can be added without invalidating the…