Critical ScreenConnect Flaw Puts Remote Sessions at Risk

ConnectWise has released a crucial security advisory concerning a vulnerability in its ScreenConnect software, widely used for remote desktop management. This flaw allows attackers to potentially extract machine keys and hijack sessions without authentication.

Details of the ScreenConnect Vulnerability

The vulnerability, identified as CVE-2026-3564, impacts all versions of ScreenConnect before 26.1 and has been given a CVSS score of 9.0, indicating a critical severity level. The core issue lies in how older versions stored machine keys and cryptographic identifiers, which were saved in plaintext within server configuration files.

This storage method means that if an attacker accesses the filesystem or configuration data, they could extract these keys without requiring elevated privileges. Once obtained, these keys can be exploited to forge session tokens, allowing unauthorized access to remote sessions.

Implications and Required Actions

This vulnerability is categorized under CWE-347, due to the software’s failure to verify cryptographic signatures effectively. The CVSS vector highlights the network exploitability, requiring no user interaction, though a high attack complexity signifies that specific conditions must be met.

ConnectWise has prioritized this issue with a Priority 1 rating, suggesting it is either currently being targeted or at high risk of exploitation. Organizations using on-premises ScreenConnect should consider this an emergency and update to version 26.1 immediately.

Mitigation Strategies and Updates

The updated version 26.1 resolves the issue by implementing encrypted storage and improved key management, reducing the risk of unauthorized access even if server integrity is compromised. Cloud-hosted instances of ScreenConnect have already had backend mitigations applied by ConnectWise, requiring no further action from users.

For organizations with on-premises deployments, it is crucial to manually upgrade to version 26.1 via the official ScreenConnect download page. Additionally, maintenance licenses must be current to apply the update.

In light of the critical nature of this vulnerability, security teams should prioritize patching and review session logs for any unusual authentication activity that might indicate past exploitation attempts.

Stay informed on the latest cybersecurity developments by following us on Google News, LinkedIn, and X. Contact us to share your cybersecurity stories.