# CVE-2026-3564: ConnectWise ScreenConnect improper cryptographic signature verification in server

Source: https://junglewise.ai/threats/cve-2026-3564-connectwise-screenconnect-improper-cryptographic-signature  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-17. Updated: 2026-07-09  
License: CC BY 4.0 with a link back

CVE-2026-3564 · Severity: critical · CVSS 9 · Published 2026-03-17

ConnectWise ScreenConnect is a remote desktop software used by IT teams to provide technical support and manage computers. A vulnerability in the server component could allow an attacker who has obtained specific server security keys to bypass authentication and gain full control over the system, including elevated administrative privileges. This could lead to unauthorized access to all managed customer machines and sensitive data.

Technologies: [ConnectWise ScreenConnect](https://junglewise.ai/threats/technologies/screenconnect). Vendors: [ConnectWise](https://junglewise.ai/threats/vendors/connectwise).

## Quick answers

**Is CVE-2026-3564 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-3564 being exploited in the wild.

**How severe is CVE-2026-3564?** Critical severity, with a CVSS score of 9, published 17 March 2026.

**Which products and versions are affected?** ConnectWise ScreenConnect All server versions prior to 26.1.

**Is there a fix for CVE-2026-3564?** A patch was published on 2026-03-17: Fixed in version 26.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-3564 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-3564?** Check whether you run ConnectWise ScreenConnect at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in the ConnectWise ScreenConnect server component due to improper verification of cryptographic signatures (CWE-347). In versions prior to 26.1, unique machine keys used for authentication were stored within server configuration files in a manner that could allow an attacker with access to this cryptographic material to forge authentication tokens. While the attack complexity is high because it requires prior access to server-level secrets, a successful exploit allows for complete authentication bypass and privilege escalation. ConnectWise has addressed this in version 26.1 by implementing encrypted storage and improved management for these machine keys.

## Affected products

- ConnectWise ScreenConnect All server versions prior to 26.1

## Timeline

- 2026-03-17: disclosed
- 2026-03-17: patched: Fixed in version 26.1
- 2026-03-17: advisory

## References

- [https://www.connectwise.com/company/trust/security-bulletins/2026-03-17-screenconnect-bulletin](https://www.connectwise.com/company/trust/security-bulletins/2026-03-17-screenconnect-bulletin)

## Related threats

- [ConnectWise ScreenConnect unauthorized file transfer and execution](https://junglewise.ai/threats/cve-2026-84869-connectwise-screenconnect-unauthorized-file-transfer-and)
- [ConnectWise ScreenConnect improper input validation in Host Pass creation](https://junglewise.ai/threats/cve-2026-11596-connectwise-screenconnect-improper-input-validation-in-host-pass)
- [ConnectWise ScreenConnect path traversal](https://junglewise.ai/threats/cve-2024-1708-connectwise-screenconnect-path-traversal)
- [In versions of ScreenConnect™ prior to 25.8, server-side validation and integrity checks within the extension…](https://junglewise.ai/threats/cve-2025-14265-in-versions-of-screenconnect-prior-to-25-8-server-side-validation)
- [ConnectWise ScreenConnect remote code execution via ViewState injection](https://junglewise.ai/threats/cve-2025-3935-connectwise-screenconnect-remote-code-execution-via-viewstate)