ScreenConnect Pre-Auth Token Lifetime Bypass via Host Pass Input Validation (CVE-2026-11596)

CVE-2026-11596 Vulnerability Overview In ScreenConnect™ versions prior to 26.2, an input validation flaw in the Host Pass creation feature allows users with privileges to create Host Passes to specify a token expiration duration exceeding the expected maximum. This bypasses server-side validation of token lifecycle constraints when generating delegated access tokens. This issue has been fully remediated in version 26.2, released on April 29, 2026. Affected Versions ScreenConnect versions prior to 26.2 Remediation Cloud: No action required. ScreenConnect servers have already been updated to a version that addresses this issue. On-Premise: - Upgrade to ScreenConnect version 26.2 or later. - Download and apply the update from the Download - If the license has passed its maintenance period, upgrade the license before installing the latest supported version. - For instructions on updating to the latest version, refer to Upgrade an on-premises installation - ConnectWise. Automation On-Prem Partners and ScreenConnect Integration For ScreenConnect deployments integrated with Automate, apply ScreenConnect 26.2 or the latest version available via the Automate Product Updates page. If the ScreenConnect license has passed its maintenance period, renew or upgrade the license before installing the latest supported version. Review the ScreenConnect 26.2 release notes. Fixed Versions ScreenConnect 26.2 and later References https://screenconnect.product.connectwise.com/communities/26/topics/5102-screenconnect-262 https://www.cve.org/cverecord?id=CVE-2026-11596

Goal Reached Thanks to every supporter — we hit 100%!

ScreenConnect Pre-Auth Token Lifetime Bypass via Host Pass Input Validation (CVE-2026-11596)

More from this source