ScreenConnect Flaw Hackers Steal Machine Keys
ConnectWise has released a critical security update for its ScreenConnect remote desktop software to address a severe vulnerability that allows attackers to hijack user sessions.
The flaw, which compromises the protection of server-level cryptographic material, prompted the company to issue a Priority 1 security bulletin, warning users of a high risk of active exploitation in the wild.
Tracked under CVE-2026-3564, the vulnerability stems from improper verification of cryptographic signatures within the software architecture and is officially categorized as CWE-347.
Older versions of ConnectWise ScreenConnect inherently stored unique machine keys per instance directly within server configuration files.
Under specific network conditions, an unauthorized threat actor who compromises server integrity can extract this sensitive cryptographic material.
Once attackers possess the machine keys, they can misuse them to forge session authentication.
This critical failure allows hackers to hijack active remote sessions, granting them unauthorized access to connected endpoints and compromising confidential data.
The security flaw carries a critical CVSS v3.1 base score of 9.0 out of 10. The complete attack vector string evaluates to CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, reflecting the severe confidentiality, integrity, and availability impacts on compromised systems despite the high attack complexity.
All deployments of ScreenConnect before version 26.1 are vulnerable to this exploit.
To neutralize this threat, ConnectWise rolled out ScreenConnect version 26.1, which introduces significant security hardening measures for authentication processes.
The update completely overhauls how the software handles machine keys, replacing localized configuration file storage with encrypted storage and active key management.
This architectural enhancement drastically reduces the risk of unauthorized access, preventing session hijacking even when the broader server environment has been compromised.
ConnectWise classifies this flaw as a Priority 1 threat, indicating that organizations should treat this patch as an emergency change that requires deployment within days.
For organizations using cloud-hosted ScreenConnect instances, ConnectWise has already applied the necessary patches on the backend infrastructure.
No further action is required for cloud customers to remain protected against this specific vulnerability.
On-premise administrators, however, must take immediate manual action to secure their environments.
Organizations running local deployments need to download and install ScreenConnect version 26.1 directly from the ConnectWise portal.
Administrators with expired maintenance licenses must renew their licenses before they can apply this critical update.
Furthermore, partners who rely on an on-premises ScreenConnect installation integrated with ConnectWise Automate can acquire the 26.1 update directly through the standard Automate Product Updates page.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…