ConnectWise ScreenConnect CVE-2026-11596

Exploitation requires an authenticated session in ScreenConnect with the Host Pass creation privilege explicitly granted - this is not a default user capability and must be assigned by an administrator. The vulnerability is scoped entirely to the Host Pass creation workflow; no other ScreenConnect functionality is implicated. The CVSS vector PR:H confirms that high-privilege authentication is a hard prerequisite. Exploitation is limited to users who: (1) possess valid ScreenConnect credentials, and (2) hold the specific Host Pass creation role. Unauthenticated attackers and standard authenticated users without the Host Pass role cannot trigger this vulnerability. There is no user interaction requirement once the privileged session is established.

The CVSS 3.1 base score of 4.7 (Medium) is consistent with the attack surface: AV:N confirms network reachability, AC:L indicates low exploitation complexity once access is established, but PR:H significantly constrains the realistic threat population to users who already hold Host Pass creation privileges - a non-default, explicitly granted role. The C:L/I:L/A:L impact triplet and unchanged scope (S:U) indicate limited blast radius contained within ScreenConnect itself. No EPSS data was provided in the source intelligence; no KEV listing exists; no POC is referenced. The practical risk is a persistence/access-control bypass rather than initial compromise - an insider threat or a compromised Host Pass-privileged account could use this to lock in longer-than-permitted delegated sessions before their elevated access is revoked. This is a real but narrow risk, not a broad attack-surface concern. Organizations that grant Host Pass creation rights broadly or use ScreenConnect for third-party vendor access should treat this as higher priority.

An insider or attacker who has compromised a ScreenConnect account with Host Pass creation privileges navigates to the Host Pass generation interface and submits a token duration value exceeding the intended maximum - for example, specifying a multi-year expiration rather than the allowed maximum of hours or days. The system accepts the out-of-bounds value and issues a long-lived delegated access token. The attacker distributes or retains this token, maintaining persistent delegated access to target systems through ScreenConnect even after their primary account credentials are rotated or revoked. No public POC has been identified at time of analysis.