Critical ScreenConnect Flaw Exposes Machine Keys and Enables Session Hijacking

ConnectWise ScreenConnect disclosed a critical vulnerability, CVE-2026-3564 (CVSS 9.0), affecting versions prior to 26.1. The flaw stems from ScreenConnect storing unique per-instance machine keys and related cryptographic material in plaintext server configuration files, creating a path for attackers under certain conditions to extract those keys and abuse them for unauthorized access. The issue is classified as CWE-347: Improper Verification of Cryptographic Signature, and successful exploitation can undermine confidentiality, integrity, and availability in environments that rely on ScreenConnect for remote access.

With the exposed machine keys, an attacker could forge or manipulate session authentication tokens, hijack legitimate sessions, and elevate access without user interaction. ConnectWise rated the issue as high priority, and the Centre for Cybersecurity Belgium urged organizations to patch immediately, monitor for suspicious activity, and treat updates as protection against future exploitation rather than proof that no prior compromise occurred. The vendor states the issue is fixed in version 26.1, making rapid remediation and post-patch review important for on-premises deployments.