CVE-2026-3564: ConnectWise ScreenConnect Auth Bypass via Server Cryptographic Material

CVE-2026-3564: ConnectWise ScreenConnect Authentication Bypass

ConnectWise has disclosed a critical authentication bypass vulnerability in ScreenConnect, its widely deployed remote access and support platform, tracked as CVE-2026-3564 (CVSS 9.0, Critical). The flaw affects all ScreenConnect versions prior to 26.1 and stems from insecure storage of server-level cryptographic keys used for authentication token generation.

If an attacker obtains access to these machine keys — through configuration file exposure, a prior server compromise, or a chained vulnerability — they can forge authentication tokens to gain unauthorized access to ScreenConnect, potentially including elevated privileges. ConnectWise released ScreenConnect 26.1 on March 17, 2026, introducing encrypted key storage and hardened cryptographic key management.

ScreenConnect has a significant prior exploitation history. Both CVE-2024-1709 (authentication bypass) and CVE-2025-3935 (ViewState code injection via machine keys) were actively exploited in the wild and added to CISA's Known Exploited Vulnerabilities (KEV) catalog. Organizations should treat CVE-2026-3564 as high priority.

Vulnerability Overview

Technical Analysis

Machine Key Exposure and Token Forgery

Pre-26.1 versions of ScreenConnect store unique per-instance machine authentication keys in plaintext within server configuration files. These machine keys are used to sign and validate authentication tokens for ScreenConnect sessions.

The vulnerability follows a pattern closely related to CVE-2025-3935 (the ViewState machine key abuse flaw):

1. Server configuration files containing the machine key are accessible via:

   • Direct filesystem access (prior server compromise)
   • Configuration backup exposure
   • Path traversal or file read vulnerabilities chained with this CVE
   • Misconfigured web server permissions exposing config directories

2. An attacker with the machine key can construct cryptographically valid authentication tokens for arbitrary ScreenConnect user accounts

3. These forged tokens authenticate successfully, potentially granting access to any session including administrative privileges

ScreenConnect 26.1 Hardening

The 26.1 release introduces:

• Encrypted storage for server-level machine keys at rest
• Hardened key management preventing key extraction from standard configuration file reads
• Rotation mechanisms for existing deployments to invalidate any previously exposed keys

Historical Context: ScreenConnect Exploitation Pattern

ConnectWise ScreenConnect has been a repeated target for threat actors due to its wide deployment across MSPs, enterprise IT teams, and help desks — making it a high-value initial access vector:

The prior exploitation of machine-key-based attacks (CVE-2025-3935) makes CVE-2026-3564 a high-concern disclosure — threat actors are already familiar with this attack surface.

Impact Assessment

Remediation

Primary Fix: Upgrade to ScreenConnect 26.1

ConnectWise strongly urges all customers to upgrade immediately.

For cloud-hosted ScreenConnect: ConnectWise cloud instances are updated automatically — no action required.

For on-premises deployments:

1. Download ScreenConnect 26.1 from the ConnectWise Partner Portal
2. Back up your current ScreenConnect configuration directory before upgrading
3. Run the installer — the upgrade preserves existing sessions and configurations
4. Verify the new version in the ScreenConnect web admin panel under Admin > About

Post-Upgrade: Key Rotation

After upgrading to 26.1, rotate your ScreenConnect machine keys to invalidate any cryptographic material that may have been exposed:

1. Navigate to Admin > Security in the ScreenConnect web panel
2. Select Regenerate Security Keys
3. Confirm — all active sessions will require re-authentication

Immediate Mitigations (Pre-Patch)

If patching cannot be applied immediately:

1. Audit access to ScreenConnect configuration files — verify that the ScreenConnect installation directory is not web-accessible and that only administrative accounts can read config files
2. Review ScreenConnect access logs for unusual authentication patterns or unexpected geographic logins
3. Restrict ScreenConnect web interface access to known IP ranges via firewall rules
4. Enable MFA on all ScreenConnect administrative accounts

Detection

Monitor for authentication anomalies that may indicate token forgery:

# Review ScreenConnect authentication logs
# Default log location (Windows)
# C:\Program Files (x86)\ScreenConnect\App_Data\Session.db (SQLite)
 
# Check for logins from unexpected IPs or unusual session creation times
# Via ScreenConnect Admin > Reports > Session Activity

Watch for:

• Successful logins from IPs not associated with known administrators
• Session connections to endpoints without corresponding support tickets
• Administrative action logs showing bulk operations or configuration changes

Key Takeaways

1. CVE-2026-3564 allows authentication token forgery in ScreenConnect if server-level machine keys are obtained — a prerequisite met by any prior server compromise or file exposure
2. CVSS 9.0 (Critical) — no authentication required at the network level; scope change means impacts extend beyond the ScreenConnect server to all managed endpoints
3. Prior ScreenConnect CVEs (2024-1709, 2025-3935) were actively exploited and KEV-listed — threat actors are already familiar with this attack surface and this disclosure will attract significant interest
4. Cloud-hosted instances are auto-patched — on-premises deployments require immediate manual upgrade to ScreenConnect 26.1
5. Rotate security keys after upgrading to invalidate any cryptographic material that may have been previously exposed
6. MSPs and enterprise IT teams using ScreenConnect to manage large endpoint fleets face cascading compromise risk and should prioritize this remediation

Sources

• CVE-2026-3564 — NIST NVD
• ConnectWise Security Bulletin — ScreenConnect 26.1 (2026-03-17)
• ScreenConnect Critical Unauthorized Access via Cryptographic Material — TheHackerWire
• CVE-2026-3564 — THREATINT