A condition in the ScreenConnect server component may allow an actor with access to server-level cryptographic material used for authentication to obtain unauthorized access, including elevated privileges, in certain scenarios. ScreenConnect host and guest client agents are not independently affected by this CVE.
\n\nCloud: No action is required. ScreenConnect servers hosted in\n“screenconnect.com” cloud (standalone and Automate/RMM integrated) or\n“hostedrmm.com” for Automate partners have been updated to remediate the\nissue.
\n\nOn-premise ScreenConnect Partners:
\n\n\n\nPlease upgrade to ScreenConnect Server version 26.1. Visit Download\n| ScreenConnect page to download and apply the update (access\nrequires a valid on-premises license).
\n\n\n\nAutomate On-Prem Partners with ScreenConnect\nIntegration:
\n\nFor partners using an on-premises ScreenConnect\ninstallation integrated with Automate, ScreenConnect 26.1 is available through\nthe Automate Product Updates page.
Link to release\nnotes: ScreenConnect 26.1 / ScreenConnect
"}],"value":"Cloud: No action is required. ScreenConnect servers hosted in\n“screenconnect.com” cloud (standalone and Automate/RMM integrated) or\n“hostedrmm.com” for Automate partners have been updated to remediate the\nissue. \n\n\n\n\n\nOn-premise ScreenConnect Partners:\n\n\n\n\n\n\n\nPlease upgrade to ScreenConnect Server version 26.1. Visit Download\n| ScreenConnect page to download and apply the update (access\nrequires a valid on-premises license). \n\n\n\n\n\n\n\n\n\n * If your license is out of maintenance, you must upgrade your license https://docs.connectwise.com/ScreenConnect_Documentation/On-premises/On-premises_licensing/Renew_or_upgrade_an_on-premises_license before installing\nthe latest supported release of ScreenConnect. \n * For\ninstructions on updating to the newest release, please reference this\ndoc: Upgrade an on-premise\ninstallation - ConnectWise \n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nAutomate On-Prem Partners with ScreenConnect\nIntegration:\n\n\n\n\n\nFor partners using an on-premises ScreenConnect\ninstallation integrated with Automate, ScreenConnect 26.1 is available through\nthe Automate Product Updates https://docs.connectwise.com/ConnectWise_Automate_Documentation/Automate_Product_Updates page.\n\n\n\n\n\n\n\n\n\n\nLink to release\nnotes: ScreenConnect 26.1 / ScreenConnect https://screenconnect.product.connectwise.com/communities/26/topics/5088-screenconnect-261"}],"source":{"discovery":"UNKNOWN"},"title":"ScreenConnect Instance Level Cryptographic Material Exposure","x_generator":{"engine":"Vulnogram 0.5.0"}}},"cveMetadata":{"assignerOrgId":"7d616e1a-3288-43b1-a0dd-0a65d3e70a49","assignerShortName":"ConnectWise","cveId":"CVE-2026-3564","datePublished":"2026-03-17T14:48:59.940Z","dateReserved":"2026-03-04T20:04:12.757Z","dateUpdated":"2026-07-09T17:20:18.051Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-03-17 15:16:19","lastModifiedDate":"2026-07-09 18:16:51","problem_types":["CWE-347","CWE-347 CWE-347 Improper Verification of Cryptographic Signature"],"metrics":{"cvssMetricV31":[{"source":"7d616e1a-3288-43b1-a0dd-0a65d3e70a49","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-03-17T00:00:00+00:00","id":"CVE-2026-3564","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"3564","Ordinal":"1","Title":"ScreenConnect Instance Level Cryptographic Material Exposure","CVE":"CVE-2026-3564","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"3564","Ordinal":"1","NoteData":"A condition in the ScreenConnect server component may allow an actor with access to server-level cryptographic material used for authentication to obtain unauthorized access, including elevated privileges, in certain scenarios. ScreenConnect host and guest client agents are not independently affected by this CVE.","Type":"Description","Title":"ScreenConnect Instance Level Cryptographic Material Exposure"}]}}}