CVE-2026-11596: falha de média gravidade em ConnectWise ScreenConnect
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.7epss 0.2%
In ScreenConnect™ versions prior to 26.2, input
validation within the Host Pass creation functionality could allow an
authenticated user with Host Pass creation privileges the ability to specify a
token expiration duration beyond the intended maximum when generating delegated
access tokens.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Produtos afetados
ConnectWise · ScreenConnectCVEs relacionadas — ConnectWise ScreenConnect
No mesmo produto, das mais perigosas para as menos.
CVE-2024-1709CRITICALAuthentication bypass using an alternate path or channelEPSS 100.0%KEVCVE-2024-1708HIGHImproper limitation of a pathname to a restricted directory (“path traversal”)EPSS 95.4%KEVCVE-2025-3935HIGHScreenConnect Exposure to ASP.NET ViewState Code InjectionEPSS 3.6%KEVCVE-2026-84869CRITICALScreenConnect Client: Guest-to-Host File Execution via File-Transfer ActionsEPSS 0.9%KEVCVE-2022-36781MEDIUMConnectWise - ScreenConnect Session Code BypassEPSS 0.6%CVE-2026-3564CRITICALScreenConnect Instance Level Cryptographic Material ExposureEPSS 0.4%