Vulnerability Intelligence Report
ScreenConnect Instance Level Cryptographic Material Exposure
CVE-2026-3564
A condition in the ScreenConnect server component may allow an actor with access to server-level cryptographic material used for authentication to obtain unauthorized access, including elevated privileges, in certain scenarios. ScreenConnect host and guest client agents are not independently affected by this CVE.
No Active Exploit Signals
CVSS Base Score
9.0
CRITICAL
Exploitability:2.3
Impact Score:6.1
EPSS Probability:0.36%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-347 ↗CWE-347 Improper Verification of Cryptographic Signature
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| ConnectWise | ScreenConnect | All server versions prior to 26.1 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
0.362%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | ConnectWise LLC · Vendor · USA |
| Reserved | 2026-03-04T20:04:12 |
| Published | 2026-03-17T14:48:59 |
| Last Updated | 2026-07-09T17:20:18 |
Community Chatter & Buzz