4.7Medium
CVE-2026-11596
Description
In ScreenConnect™ versions prior to 26.2, input validation within the Host Pass creation functionality could allow an authenticated user with Host Pass creation privileges the ability to specify a token expiration duration beyond the intended maximum when generating delegated access tokens.
Weakness (CWE):
CWE-1284
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| ConnectWise | ScreenConnect | All versions prior to 26.2 |
References and patches
- https://github.com/ConnectWise-Advisories/Disclosures/tree/main/CVE-2026-11596 PatchVendor Advisory
CPE matches (NVD) (1)
cpe:2.3:a:connectwise:screenconnect:*:*:*:*:*:*:*:*< 26.2.2.9585