CVE-2026-11596 — ConnectWise / ScreenConnect

CVE-2026-11596

ConnectWise / ScreenConnect PUBLISHED

Description (CNA)

In ScreenConnect™ versions prior to 26.2, input validation within the Host Pass creation functionality could allow an authenticated user with Host Pass creation privileges the ability to specify a token expiration duration beyond the intended maximum when generating delegated access tokens.

Affected (CNA)

Vendor / product	Versions
ConnectWise / ScreenConnect	affected All versions prior to 26.2

CWE

CWE-1284

References

https://github.com/ConnectWise-Advisories/Disclosures/tree/main/CVE-2026-11596

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.