A condition in ScreenConnect allows an actor who gains access to the server‑level cryptographic material used for authentication to obtain unauthorized access, including elevated privileges. This vulnerability is tied to the improper handling or exposure of authentication keys, which the vendor identifies as CWE‑347. The resulting impact can elevate an attacker’s capabilities from simple authentication bypass to full administrative control over the affected instance.

The vulnerability affects ConnectWise ScreenConnect installations, including cloud‑hosted services (screenconnect.com and hostedrmm.com) and on‑premise deployments. Vendor guidance indicates that any on‑premise instance running a version older than 26.1 is vulnerable, as the fix is delivered in ScreenConnect 26.1. On‑premise integrations with Automate also require updating to 26.1 via the Automate Product Updates portal.

The CVSS score of 9 denotes a critical severity. While the EPSS score is not available, the requirement of accessing server‑level cryptographic material suggests that the exploit is most likely possible only after an actor has compromised the host or obtained privileged credentials. The vulnerability is not currently listed in the CISA KEV catalog, but the high CVSS, possible internal or remote exploitation, and potential for full system compromise warrant immediate securing actions.