CVE-2026-3564

CriticalCVSS 9.0/10Last modified Jul 9, 2026

Description

A condition in the ScreenConnect server component may allow an actor with access to server-level cryptographic material used for authentication to obtain unauthorized access, including elevated privileges, in certain scenarios. ScreenConnect host and guest client agents are not independently affected by this CVE.

Metrics

CVSS 3.1 9.0/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-347

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Mar 17, 2026
Last modified
Jul 9, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-356407.5OpenClaw before 2026.3.25 parses JSON request bodies before validating webhook signatures, allowing unauthenticated attackers to force resouCVE-2026-356417.8OpenClaw before 2026.3.24 contains an arbitrary code execution vulnerability in local plugin and hook installation that allows attackers to CVE-2026-356424.3OpenClaw before 2026.3.25 contains an authorization bypass vulnerability where group reaction events bypass the requireMention access controCVE-2026-356438.8OpenClaw before 2026.3.22 contains an unvalidated WebView JavascriptInterface vulnerability allowing attackers to inject arbitrary instructiCVE-2026-356446.5OpenClaw before 2026.3.22 contains an information disclosure vulnerability that allows attackers with operator.read scope to expose credentiCVE-2026-356458.8OpenClaw before 2026.3.25 contains a privilege escalation vulnerability in the gateway plugin subagent fallback deleteSession function that CVE-2026-356466.5OpenClaw before 2026.3.25 contains a pre-authentication rate-limit bypass vulnerability in webhook token validation that allows attackers toCVE-2026-356475.3OpenClaw before 2026.3.25 contains an access control vulnerability where verification notices bypass DM policy checks and reply to unpaired CVE-2026-356485.9OpenClaw before 2026.3.22 contains a policy bypass vulnerability where queued node actions are not revalidated against current command policCVE-2026-356496.5OpenClaw before 2026.3.22 contains a settings reconciliation vulnerability that allows attackers to bypass intended deny-all revocations by CVE-2026-35654.3The Taqnix plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3. This is due to a miCVE-2026-356508.8OpenClaw before 2026.3.22 contains an environment variable override handling vulnerability that allows attackers to bypass the shared host e
CVE-2026-3564: Critical severity, CVSS 9.0 | Vulnix