CVE-2026-11596 - In ScreenConnect™ versions prior to 26.2, input

Back Back to CVE browser

MEDIUM

In ScreenConnect™ versions prior to 26.2, input

Published Jun 10, 2026

4.7

MEDIUM

CVSS 3.1

EPSS 0.24%

Description

In ScreenConnect™ versions prior to 26.2, input validation within the Host Pass creation functionality could allow an authenticated user with Host Pass creation privileges the ability to specify a token expiration duration beyond the intended maximum when generating delegated access tokens.

Affected products

Vendor ConnectWise Product ScreenConnect Default
unaffected
- Version
  All versions prior to 26.2
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

ConnectWise

ScreenConnect

unaffected

Version	Status	Constraints
All versions prior to 26.2	affected	-

Remediation

Vendor solution

Cloud: No action is required. ScreenConnect servers hosted in the ScreenConnect cloud environment have been updated to remediate this issue.

On-prem: Upgrade to ScreenConnect version 26.2 or later.

Weaknesses (1)

CWE-1284

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-36079
Advisory
https://github.com/ConnectWise-Advisories/Disclosures/tree/main/CVE-2026-11596
PatchVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-36079		Advisory
https://github.com/ConnectWise-Advisories/Disclosures/tree/main/CVE-2026-11596		PatchVendor Advisory