What’s Vulnerable › Vulnerabilities
CVE-2026-11596
- Severity: medium (CVSS 4.7 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-06-10 · updated 2026-10-26
- Weakness: CWE-1284
Description
In ScreenConnect™ versions prior to 26.2, input validation within the Host Pass creation functionality could allow an authenticated user with Host Pass creation privileges the ability to specify a token expiration duration beyond the intended maximum when generating delegated access tokens.
Affected products
- ConnectWise ScreenConnect: before 26.2.2.9585 — fixed in 26.2.2.9585
How to fix
Upgrade to a fixed version: ConnectWise ScreenConnect 26.2.2.9585. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-11596 or the next vulnerability affects your stack