CVE-2026-3564

ScreenConnect is often used to remotely connect to computers for support and maintenance. This flaw is in the ScreenConnect server’s authentication protections: if an attacker gets access to specific internal encryption keys used by the server, they can skip normal security checks and take control. Importantly, the affected issue is in the server—devices running the ScreenConnect client on users’ computers are not independently affected by this CVE.

This matters if you use the ScreenConnect server for remote access/IT support (on your own server or as your ScreenConnect-hosted service). It does not depend on end-users clicking anything, and attackers can reach the server over the network without needing a login. The key reachability gate described here is that the attacker must be able to access the server-level cryptographic material used for authentication; it is also being exploited in active attacks, so you should assume exposure is real when your ScreenConnect server is reachable and not yet remediated.

This is RED because it is actively exploited in real attacks, and CISA directed U.S. agencies to secure systems against ongoing exploitation. The attack path does not require logins or user interaction, making successful compromise more likely when an unpatched ScreenConnect server is reachable. Treat this as an emergency patch-and-restrict issue.

1. Confirm your deployment type

   • Determine whether your ScreenConnect instances are:
     • Hosted in the ScreenConnect cloud (screenconnect.com, including standalone and Automate/RMM integrated), or
     • Hosted in hostedrmm.com for Automate partners, or
     • On-premises (you manage the ScreenConnect server yourself).

2. Confirm remediation status

   • If you are cloud-hosted on screenconnect.com or hostedrmm.com: the vendor finding states those ScreenConnect servers have been updated to remediate this issue; focus on verifying that your specific instance is still on the vendor-managed hosting environment and not an on-prem server.
   • If you are on-premises: upgrade the ScreenConnect server to the vendor’s remediation update (apply the latest available ScreenConnect server update from the vendor advisory for CVE-2026-3564). The findings provided here do not include a specific fixed version number for on-prem, so you must follow the vendor’s remediation guidance for the correct updated build.

3. Check whether the server is reachable from untrusted networks

   • Validate what networks can reach the ScreenConnect server. If it is exposed publicly, move it behind your approved access method (for example, VPN or IP allowlists) or otherwise restrict inbound connectivity to only the networks/users who must use it.

4. Hunt for compromise signals in logs

   • Review ScreenConnect server logs for:
     • Unexpected administrative access (new admin sessions, privilege changes)
     • Unusual authentication or authorization events
     • Administrative actions outside your normal support windows
   • If you see signs of unauthorized admin access, treat this as an incident: preserve logs, isolate the server from the network (if feasible), and begin containment steps while you coordinate with your IT/security team.

5. Temporary containment if patching is delayed

   • If you cannot complete the upgrade immediately, restrict external reachability to the ScreenConnect server immediately (disable or strongly limit inbound access from the internet) while keeping only essential internal access working.

6. Ongoing monitoring after remediation

   • Continue monitoring for unexpected admin activity until you confirm no suspicious events occurred during the window before remediation.

Note on KEV and timing: this CVE is reported as actively exploited, and CISA added it to its catalog of known exploited vulnerabilities / issued direction to secure against ongoing attacks. The findings do not provide a specific CISA due date in the provided text.

Severity is critical (attackers gain full control, including elevated privileges, on the ScreenConnect server). The weakness is CWE-347 (Improper Verification of Cryptographic Signatures/Material), described here as exposure of cryptographic material used for authentication logic, allowing an attacker who has access to the relevant server-level encryption keys to bypass standard security checks. Attack characteristics from the findings: network-based, no authentication required to attempt the scenario, and no user interaction needed. Exploitation status: exploitation is reported as YES, and the findings state CISA directed federal agencies to secure systems against ongoing attacks and added it to its catalog of known exploited vulnerabilities (KEV not listed in the provided CISA KEV section, but the NEWS report explicitly describes CISA action).

Exploit maturity: no public exploit code is on record per the findings, which can lower “easy script kiddie” odds, but the active exploitation report means real-world attackers are already using it.

Reachability depends on server conditions: the attacker must have access to server-level cryptographic material used for authentication; additionally, the server must be reachable over the network in a way that triggers the vulnerable behavior.