CVE-2026-3564CWE-347

ScreenConnect Instance Level Cryptographic Material Exposure

Critical · published March 17, 2026

CVSS v3.1
9.0
EPSS
0%
Percentile
21.1
In the wild
Unconfirmed
What it is

A condition in the ScreenConnect server component may allow an actor with access to server-level cryptographic material used for authentication to obtain unauthorized access, including elevated privileges, in certain scenarios. ScreenConnect host and guest client agents are not independently affected by this CVE.

The record
Technical detail
CVSS v3.1
9.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00295 · 21.1th percentile
Weakness
CWE-347 · Improper Verification of Cryptographic Signature
Published
2026-03-17T14:48Z
EPSS history
Timeline
  • 17 MAR 14:48Z
    ScreenConnect Instance Level Cryptographic Material Exposure
    cvelistv5