Critical ScreenConnect Vulnerability Exposes Machine Keys

ConnectWise has rolled out a security update for ScreenConnect to improve its handling of machine keys and prevent server compromise. The update addresses CVE-2026-3564 (CVSS score of 9.0), a critical-severity vulnerability that could allow attackers to access cryptographic material used for session authentication. Previously, ScreenConnect stored the unique machine keys within server configuration files, which exposed them to exfiltration in certain scenarios. The latest iteration of the remote monitoring and management solution eliminates the risk by encrypting the cryptographic material. “ScreenConnect version 26.1 introduces enhanced protections for machine key handling, including encrypted storage and management, reducing the risk of unauthorized access in scenarios where server integrity may be compromised,” ConnectWise notes in its advisory. The company assigned a ‘high’ priority rating to CVE-2026-3564, which it typically slaps on bugs “that are either being targeted or have higher risk of being targeted by exploits in the wild.” In a separate advisory, ConnectWise notes that it is aware of attempts to abuse disclosed ASP.NET machine key material, which is used to sign and validate protected application data. Threat actors could use this cryptographic material to elevate their privileges within ScreenConnect and to access active sessions, which could lead to server compromise. “If the machine key material for a ScreenConnect instance is disclosed, a threat actor may be able to generate or modify protected values in ways that may be accepted by the instance as valid. This can result in unauthorized access and unauthorized actions within ScreenConnect,” the company said. The flaw was allegedly exploited by Chinese state-sponsored hackers for years, but ConnectWise says it has no evidence to validate the claims.  “The references in the advisory relate to our ongoing efforts to strengthen the security of ScreenConnect, including hardening measures around the use and management of ASP.NET machine key material. This work is part of a broader initiative to reduce attack surface and enhance product security, informed by continuous internal review and lessons learned from prior industry events,” a ConnectWise spokesperson told SecurityWeek. Users are advised to update to ScreenConnect version 26.1 as soon as possible, to review access controls and restrict access to configuration files and backups, and to monitor logs for unusual activity. Related: Apple Debuts Background Security Improvements With Fresh WebKit Patches Related: Researcher Discovers 4th WhatsApp View Once Bypass; Meta Won’t Patch Related: Chrome 146 Update Patches Two Exploited Zero-Days Related: Apple Updates Legacy iOS Versions to Patch Coruna Exploits WRITTEN BY Ionut Arghire Ionut Arghire is an international correspondent for SecurityWeek. More from Ionut Arghire Raven Emerges From Stealth With $20 Million in Funding ‘DarkSword’ iOS Exploit Kit Used by State-Sponsored Hackers, Spyware Vendors EU Sanctions Chinese, Iranian Firms Supporting Hacking Operations Manifold Raises $8 Million for AI Detection and Response Apple Debuts Background Security Improvements With Fresh WebKit Patches Tech Giants Invest $12.5 Million in Open Source Security Robotic Surgery Giant Intuitive Discloses Cyberattack 174 Vulnerabilities Targeted by RondoDox Botnet Latest News Oasis Security Raises $120 Million for Agentic Access Management 1stProtect Emerges From Stealth With $20 Million in Funding Privacy Platform Cloaked Raises $375M to Expand Enterprise Reach Iran Readied Cyberattack Capabilities for Response Prior to Epic Fury Marquis Data Breach Affects 672,000 Individuals Security Firm Aura Discloses Data Breach Impacting 900,000 Records Hacker Conversations: Ben Harris, From Unintentional Young Hacker to Intentional Adult CEO Russian APT Exploits Zimbra Vulnerability Against Ukraine Trending Webinar: Securing Fragile OT In An Exposed World March 10, 2026 Get a candid look at the current OT threat landscape as we move past "doom and gloom" to discuss the mechanics of modern OT exposure. Register Webinar: Why Automated Pentesting Alone Is Not Enough April 7, 2026 Join our live diagnostic session to expose hidden coverage gaps and shift from flawed tool-level evaluations to a comprehensive, program-level validation discipline. Register People on the Move SecurityBridge has promoted Holger Hügel to Chief Technology Officer. Armis has appointed Simon Mouyal as Chief Marketing Officer. Omada has named Jakob H. Kraglund as Chief Executive Officer. More People On The Move Expert Insights The Human IOC: Why Security Professionals Struggle With Social Vetting Applying SOC-level rigor to the rumors, politics, and 'human intel' can make or break a security team. (Joshua Goldfarb) How To 10x Your Vulnerability Management Program In The Agentic Era The evolution of vulnerability management in the agentic era is characterized by continuous telemetry, contextual prioritization and the ultimate goal of agentic remediation. (Nadir Izrael) SIM Swaps Expose A Critical Flaw In Identity Security SIM swap attacks exploit misplaced trust in phone numbers and human processes to bypass authentication controls and seize high-value accounts. (Torsten George) Four Risks Boards Cannot Treat As Background Noise The goal isn’t about preventing every attack but about keeping the business running when attacks succeed. (Steve Durbin) How To Eliminate The Technical Debt Of Insecure AI-Assisted Software Development Developers must view AI as a collaborator to be closely monitored, rather than an autonomous entity to be unleashed. Without such a mindset, crippling tech debt is inevitable. (Matias Madou) Flipboard Reddit Whatsapp Email