CVE-2026-11596: 
ScreenConnect Server vulnerability analysis and mitigation

CVE-2026-11596 is an improper input validation vulnerability in ConnectWise ScreenConnect™ affecting all versions prior to 26.2. The flaw exists within the Host Pass creation functionality, allowing an authenticated user with Host Pass creation privileges to specify a token expiration duration beyond the intended maximum when generating delegated access tokens. It was disclosed on June 10, 2026, with the patch released on April 29, 2026 in version 26.2. The vulnerability carries a CVSS v3.1 base score of 4.7 (Medium) (ConnectWise Advisory, GitHub Advisory).

The root cause is classified as CWE-1284 (Improper Validation of Specified Quantity in Input), where the server-side logic fails to enforce the maximum allowable token lifetime during Host Pass creation. An authenticated attacker with Host Pass creation privileges can manipulate the token expiration duration parameter in the delegated access token generation request, bypassing the intended policy ceiling. This requires network access and high privileges (Host Pass creation rights), but no user interaction. No public proof-of-concept or detailed technical write-up has been identified at this time (ConnectWise Advisory, GitHub Advisory).

Successful exploitation allows an authenticated user with Host Pass creation privileges to generate delegated access tokens with validity periods exceeding the organization's intended policy limits, resulting in prolonged unauthorized access to managed endpoints. The impact spans low-level confidentiality, integrity, and availability concerns, as the extended token could be used to maintain persistent access beyond what administrators intended to grant. This could facilitate unauthorized remote access to managed systems over an extended window, increasing the risk of data exposure or lateral movement if the token is misused or compromised (ConnectWise Advisory).

There is no evidence of public proof-of-concept exploit code or active in-the-wild exploitation at this time. The EPSS score is approximately 0.05% (0.000500), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated account with Host Pass creation privileges, significantly limiting the attacker pool (GitHub Advisory, ConnectWise Advisory).

1. Reconnaissance: Identify a ScreenConnect instance running a version prior to 26.2, either on-premises or cloud-hosted, and obtain credentials for an account with Host Pass creation privileges.
2. Authenticate: Log in to the ScreenConnect administration interface using the privileged account.
3. Initiate Host Pass creation: Navigate to the Host Pass creation functionality within the ScreenConnect interface.
4. Manipulate token expiration: Intercept or craft the Host Pass creation request (e.g., using a proxy tool such as Burp Suite) and modify the token expiration duration parameter to a value exceeding the intended maximum enforced by policy.
5. Generate extended token: Submit the manipulated request; due to insufficient server-side validation, the system issues a delegated access token with the attacker-specified extended expiration duration.
6. Leverage extended access: Use the long-lived delegated access token to maintain persistent remote access to managed endpoints beyond the intended policy window (ConnectWise Advisory).

• Logs: ScreenConnect audit logs showing Host Pass creation events with unusually long or anomalous token expiration durations; repeated Host Pass generation by a single account in a short timeframe.
• Network: Delegated access sessions initiated using Host Pass tokens that remain active well beyond the organization's standard maximum token lifetime policy.
• Application: Presence of active Host Pass tokens with expiration timestamps significantly exceeding the configured maximum; tokens issued outside of normal administrative hours.
• Process/Behavior: Remote sessions authenticated via Host Pass tokens that persist longer than expected, particularly from accounts not typically associated with Host Pass usage (ConnectWise Advisory).

ConnectWise released ScreenConnect version 26.2 on April 29, 2026, which fully remediates this vulnerability. For cloud-hosted ScreenConnect environments, no action is required as the update has been applied automatically. On-premises customers should upgrade to ScreenConnect 26.2 or later via the official download page; customers with out-of-maintenance licenses must renew before upgrading. As an interim measure, organizations should restrict Host Pass creation privileges to only trusted administrators and regularly audit Host Pass creation logs for tokens with anomalous expiration durations (ConnectWise Advisory).

A Reddit thread in the r/ScreenConnect community discussed CVE-2026-11596 shortly after disclosure, indicating awareness among ScreenConnect administrators. Tenable published a Nessus detection plugin (ID 321345) for the vulnerability, enabling automated scanning for affected versions. No significant vendor statements beyond the official ConnectWise advisory or notable independent researcher commentary have been identified (ConnectWise Advisory).