CVE-2026-3564

ScreenConnect Instance Level Cryptographic Material Exposure

En bref

Sévérité: CRITICAL 9.0
EPSS: EPSS 0.37 % · centile 31 (2026-10-27)
État: PUBLISHED
Publiée: 2026-03-17
Mise à jour: 2026-07-09
Attribuée par: ConnectWise
Statut NVD: Awaiting Analysis

Description

A condition in the ScreenConnect server component may allow an actor with access to server-level cryptographic material used for authentication to obtain unauthorized access, including elevated privileges, in certain scenarios. ScreenConnect host and guest client agents are not independently affected by this CVE.

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	CRITICAL 9.0	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H	ConnectWise
CVSS 3.1	CRITICAL 9.0	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H	NVD · 7d616e1a-3288-43b1-a0dd-0a65d3e70a49 (Secondary)

Faiblesses (CWE)

CWE-347

Références européennes

ENISA EUVD · EUVD-2026-12574
GCVE · GCVE-0-2026-3564

Produits affectés

Produit	Versions
ConnectWise · ScreenConnect	affected All server versions prior to 26.1

Références

https://www.connectwise.com/company/trust/security-bulletins/2026-03-17-screenconnect-bulletin

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD