Screenconnect CVE-2026-3564

Attacker must possess access to ScreenConnect server-level cryptographic material used for authentication. This requires prior compromise of server secrets or insider access to key management systems.

Despite the critical CVSS score of 9.0, the actual exploitation risk requires careful analysis. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) indicates network-accessible attack with high complexity but no privileges or user interaction required, with scope change and complete compromise of confidentiality, integrity, and availability. The high attack complexity suggests exploitation requires obtaining server-level cryptographic material first, which significantly limits the attacker pool. No EPSS score is provided to indicate real-world exploitation probability, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog, suggesting no observed in-the-wild exploitation. However, the authentication bypass nature and potential for complete system takeover make this a priority for organizations using ScreenConnect, especially those with higher exposure to sophisticated threat actors.

An attacker who compromises a ScreenConnect server through other means or obtains cryptographic key material via insider threat or supply chain attack could forge authentication tokens to impersonate any user, including administrators. Once authenticated with elevated privileges, the attacker gains full control over all managed endpoints connected to the ScreenConnect instance, potentially compromising an entire enterprise fleet of systems. The high attack complexity in the CVSS score suggests this scenario requires significant technical sophistication or prior access to cryptographic materials.