Loading vulnerability…
ConnectWise ScreenConnect Machine Key Exposure and Authentication Bypass
CVE-2026-3564 is a critical vulnerability in ConnectWise ScreenConnect server versions prior to 26.1 involving inadequate protection and verification of server-level cryptographic authentication material, including ASP.NET machine keys. In affected versions, instance-specific cryptographic material was stored in server configuration data in a manner that could be exposed under certain conditions. An attacker who obtains this material can generate or modify protected values accepted by the ScreenConnect instance as valid, enabling abuse of session authentication and unauthorized access. The ScreenConnect host and guest client agents are not independently affected; the issue resides in the server component and its handling of authentication-related cryptographic material.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can allow unauthorized access to a ScreenConnect instance, including impersonation of authenticated sessions, hijacking of active sessions, and privilege escalation to higher levels within the application. Because the exposed cryptographic material can be used to forge or manipulate authentication artifacts trusted by the server, the vulnerability can lead to compromise of confidentiality, integrity, and availability within the affected ScreenConnect environment, including unauthorized actions performed in the context of legitimate users or administrators.
If you can’t patch tonight, do this now.
Until remediation is completed, restrict access to server configuration data, secrets, backups, and historical snapshots that may contain authentication-related cryptographic material. Limit filesystem and administrative access to the ScreenConnect server, monitor for anomalous authentication and session activity, and review logs for signs of unauthorized session creation or privilege misuse. Protect stored configuration artifacts and ensure related extensions and platform components are kept current. These measures reduce exposure but do not replace upgrading to a fixed version and rotating affected cryptographic material.
Patch, then assume compromise.
Upgrade ScreenConnect to version 26.1 or later. The vendor addressed the issue by strengthening protection of server cryptographic material, including moving keys from configuration-file exposure to encrypted storage and improving key handling. Where supported, administrators should also rotate the instance cryptographic material after upgrading to invalidate previously exposed keys. Cloud-hosted instances were remediated by the vendor, while on-premises deployments require customer-driven upgrade and post-upgrade key hygiene.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
28 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.