CVE-2026-11596

Vulnerability

In ScreenConnect versions prior to 26.2, insufficient server-side validation of token lifetime constraints allows an authenticated user with Host Pass creation privileges to specify a token expiration duration beyond the intended maximum when generating delegated access tokens [1].

Exploitation

An attacker with authenticated access and Host Pass creation privileges can exploit this vulnerability by generating delegated access tokens with expiration durations exceeding intended limits. This requires no user interaction and can be performed remotely [1].

Impact

Successful exploitation allows delegated access tokens to remain valid longer than intended, potentially leading to unauthorized access or extended compromise of the affected system. The impact includes limited information disclosure, modification, and denial of service [1].

Mitigation

ScreenConnect version 26.2, released April 29, 2026, fully patches this issue. Cloud-hosted ScreenConnect servers have been automatically updated. On-premises installations must be upgraded to version 26.2 or later. Partners using Automate integration should apply the update via the Automate Product Updates page [1].