CVE-2026-3564 - Vulnerability Analysis
CriticalCVSS: 9.0Last Updated: March 18, 2026
ScreenConnect - Authentication Bypass
Overview
ScreenConnect contains an authentication bypass caused by access to server-level cryptographic material, letting attackers obtain unauthorized access including elevated privileges, exploit requires access to cryptographic material.
Severity & Score
Impact
Attackers with access to cryptographic material can gain unauthorized access and escalate privileges, compromising the system.
Mitigation
Update to the latest version with security patches addressing cryptographic material access.
References
Social Media Activity(1 post)
ConnectWise Patches Critical ScreenConnect Cryptographic Flaw ConnectWise patched a critical vulnerability (CVE-2026-3564) in ScreenConnect that allows attackers to extract cryptographic machine keys and bypass session authentication. The flaw enables unauthorized access and privilege escalation, which is a significant risk to MSPs and their downstream clients. **Treat this update as an emergency change because remote access tools are primary targets for lateral movement and supply chain attacks. If you run on-premises ScreenConnect, verify your version immediately, patch ASAP.** #cybersecurity #infosec #advisory #vulnerability https://beyondmachines.net/event_details/connectwise-patches-critical-screenconnect-cryptographic-flaw-i-v-k-f-7/gD2P6Ple2L
View original postRelated Resources
Details
- CVE ID
- CVE-2026-3564
- Severity
- Critical
- CVSS Score
- 9.0
- Type
- broken_authentication
- Status
- unconfirmed
- EPSS
- 3.4%
- Social Posts
- 1
CWE
- CWE-347
CVSS Metrics
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H