CVE-2026-3564: ScreenConnect Instance Level Cryptographic Material Exposure
- Is it exploited?
Reported, not confirmed by CISA. VulnCheck KEV lists it as exploited in the wild. CISA has not added it to its Known Exploited Vulnerabilities catalog as of .
VulnCheck KEV lists it since . It cites 3 public reports, the first from .
- How likely is exploitation in the next 30 days?
- 0.4%
Up from 0.3% on .
EPSS score, percentile 30.7 of all scored records. A probability estimated by FIRST, not a report of exploitation.
- How severe?
- 9.0 Critical
CVSS v3.1 base score, given by the CNA
- What should I do?
Cloud: No action is required. Full textSolution from the CVE record.
CISA has set no required action, because the vulnerability is not in KEV.
The CVE record links no vendor advisory, patch or mitigation.
- Which versions are affected?
Affected
- All server versions prior to 26.1
Source: CISA KEV 2026.10.29, as of ; VulnCheck KEV, as of ; FIRST EPSS, as of ; CVE List, as of . About the data.
Description
ScreenConnect Instance Level Cryptographic Material Exposure
A condition in the ScreenConnect server component may allow an actor with access to server-level cryptographic material used for authentication to obtain unauthorized access, including elevated privileges, in certain scenarios. ScreenConnect host and guest client agents are not independently affected by this CVE.
Source: CVE List, as of . About the data.
What to do
Advisories and patches
The CVE record links no vendor advisory, patch or mitigation.
Solution (from the CVE record)
Cloud: No action is required. ScreenConnect servers hosted in “screenconnect.com” cloud (standalone and Automate/RMM integrated) or “hostedrmm.com” for Automate partners have been updated to remediate the issue. On-premise ScreenConnect Partners: Please upgrade to ScreenConnect Server version 26.1. Visit Download | ScreenConnect page to download and apply the update (access requires a valid on-premises license). * If your license is out of maintenance, you must upgrade your license https://docs.connectwise.com/ScreenConnect_Documentation/On-premises/On-premises_licensing/Renew_or_upgrade_an_on-premises_license before installing the latest supported release of ScreenConnect. * For instructions on updating to the newest release, please reference this doc: Upgrade an on-premise installation - ConnectWise Automate On-Prem Partners with ScreenConnect Integration: For partners using an on-premises ScreenConnect installation integrated with Automate, ScreenConnect 26.1 is available through the Automate Product Updates https://docs.connectwise.com/ConnectWise_Automate_Documentation/Automate_Product_Updates page. Link to release notes: ScreenConnect 26.1 / ScreenConnect https://screenconnect.product.connectwise.com/communities/26/topics/5088-screenconnect-261
This summary is based on the CVE record as of . Check the vendor's advisory before you act: affected versions and fixes can change.
Affected products and versions
Versions by product, as listed in the CVE record (1 product)
| Status | Versions |
|---|---|
| Affected | All server versions prior to 26.1 |
Versions not listed are: unaffected.
Source: CVE List, as of . About the data.
Weakness
CWE-347
- CWE-347: Improper Verification of Cryptographic Signature
CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record.
Timeline
| Date | Event |
|---|---|
| CVE record published | |
| CVE record last updated |
References
1
Known exploited ConnectWise vulnerabilities
- CVE-2026-84869: ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability
- CVE-2024-1708: ConnectWise ScreenConnect Path Traversal Vulnerability
- CVE-2025-3935: ConnectWise ScreenConnect Improper Authentication Vulnerability
- CVE-2024-1709: ConnectWise ScreenConnect Authentication Bypass Vulnerability