What is the CVSS score of CVE-2026-3564?

CVE-2026-3564 has a CVSS 3.1 base score of 9.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Jwt Attack are affected by CVE-2026-3564?

A critical authentication bypass vulnerability in ConnectWise ScreenConnect (CVE-2026-3564, CVSS 9.0) enables attackers with access to cryptographic keys to impersonate any user and gain system…

How to fix or mitigate CVE-2026-3564?

Within 24 hours: Inventory all ScreenConnect installations and versions; restrict network access to ScreenConnect servers to only essential administrative personnel using firewall rules; enable enhanced logging on all ScreenConnect instances. Within 7 days: Implement network segmentation isolating ScreenConnect from critical infrastructure; rotate all cryptographic material and administrative credentials; consider disabling remote access features if operationally feasible. Within 30 days: Upgrade to ScreenConnect 26.1 or later immediately upon release; conduct forensic audit for evidence of unauthorized access; review and revoke suspicious administrative sessions.

Jwt Attack CVE-2026-3564

EUVD-2026-12574 CRITICAL

Improper Verification of Cryptographic Signature (CWE-347)

2026-03-17 ConnectWise

Authentication Bypass Jwt Attack Screenconnect

9.0

CVSS 3.1 · Vendor: ConnectWise

Severity by source

Vendor (ConnectWise) PRIMARY

9.0 CRITICAL

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from Vendor (ConnectWise) · only source for this CVE.

CVSS VectorVendor: ConnectWise

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 17, 2026 - 20:30 euvd

EUVD-2026-12574

Analysis Generated

Mar 17, 2026 - 20:30 vuln.today

CVE Published

Mar 17, 2026 - 14:48 nvd

CRITICAL 9.0

DescriptionCVE.org

A condition in ScreenConnect may allow an actor with access to server-level cryptographic material used for authentication to obtain unauthorized access, including elevated privileges, in certain scenarios.

AnalysisAI

A cryptographic authentication bypass vulnerability in ConnectWise ScreenConnect allows remote attackers who gain access to server-level cryptographic material to authenticate as any user and obtain elevated privileges. The vulnerability affects all ScreenConnect versions prior to 26.1 and carries a CVSS score of 9.0, indicating critical severity. While not currently listed in CISA's KEV catalog and with no public proof-of-concept available, the vulnerability's authentication bypass nature and potential for complete system compromise make it a high-priority patching target.

Technical ContextAI

ConnectWise ScreenConnect (CPE: cpe:2.3:a:connectwise:screenconnect:*:*:*:*:*:*:*:*) is a remote desktop and support software solution that relies on cryptographic authentication mechanisms to verify user identities. The vulnerability is classified as CWE-347 (Improper Verification of Cryptographic Signature), indicating that the application fails to properly validate cryptographic signatures or tokens used for authentication. Based on the tags mentioning 'JWT Attack', this likely involves JSON Web Token authentication where the server accepts tokens signed with compromised or improperly validated cryptographic keys, allowing attackers to forge authentication credentials.

RemediationAI

Upgrade ConnectWise ScreenConnect to version 26.1 or later immediately, as detailed in the vendor security bulletin at https://www.connectwise.com/company/trust/security-bulletins/2026-03-17-screenconnect-bulletin. Until patching is complete, organizations should audit and rotate all server-level cryptographic keys and certificates, implement network segmentation to limit ScreenConnect server exposure, enable comprehensive logging for authentication events, and monitor for suspicious authentication patterns or privilege escalations. Additional information is available from the VulDB advisory at https://vuldb.com/?id.351372.