Leaving the Doors Unlocked: Critical 9.0 CVSS ScreenConnect Flaw Exposes Machine Keys

ConnectWise issued a critical security update for ScreenConnect addressing CVE-2026-3564, a severe vulnerability (CVSS 9.0) in which unique machine keys were stored in server configuration files and could be extracted by attackers to impersonate sessions and fully compromise systems; cloud instances are updated by ConnectWise, while on-premise installations must upgrade immediately to version 26.1 which adds encrypted storage and management for machine keys.