by Kastro
Paper/Archive/CVE-2026-3564

CVE-2026-3564

ConnectWise ScreenConnect — ScreenConnect Instance Level Cryptographic Material Exposure

EPSS 0.4%CVSS 9.0
critical.is priorityof 100
33
CVSS 9.0 (CNA)9.0 / 10 × 3027.0Not in CISA KEV+300.0EPSS percentile 30.7.307 × 206.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A condition in the ScreenConnect server component may allow an actor with access to server-level cryptographic material used for authentication to obtain unauthorized access, including elevated privileges, in certain scenarios. ScreenConnect host and guest client agents are not independently affected by this CVE.

Affected

ProductAffectedFixed inSource
ScreenConnectAll server versions prior to 26.1–CNA

Scores by source

ConnectWise (CNA)9.0CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refconnectwise.com/company/trust/security-bulletins/2026-03-17-screenconnect-bulletin