CVE-2026-11596 Overview
CVE-2026-11596 is an input validation vulnerability in ConnectWise ScreenConnect™ versions prior to 26.2. The flaw resides in the Host Pass creation functionality, which fails to enforce the intended maximum token expiration duration. An authenticated user holding Host Pass creation privileges can specify a token lifetime that exceeds the configured maximum when generating delegated access tokens. This extends the validity window of delegated access beyond administrative policy. The weakness is categorized under [CWE-1284] Improper Validation of Specified Quantity in Input.
Critical Impact
Privileged users can mint delegated access tokens with extended expiration windows, prolonging unauthorized access opportunities if a token is leaked or misused.
Affected Products
- ConnectWise ScreenConnect™ versions prior to 26.2
- ScreenConnect Host Pass creation functionality
- Delegated access token issuance component
Discovery Timeline
- 2026-06-10 - CVE-2026-11596 published to NVD
- 2026-06-10 - Last updated in NVD database
Technical Details for CVE-2026-11596
Vulnerability Analysis
The vulnerability exists in ScreenConnect's Host Pass creation workflow. Host Pass tokens grant delegated access to remote support sessions. The server-side logic accepts a token expiration value supplied by the requester without validating it against the administratively configured maximum. As a result, a user with Host Pass creation privileges can issue tokens that remain valid far longer than policy permits.
Exploitation requires an authenticated session with Host Pass creation privileges, raising the bar for opportunistic attackers. The confidentiality, integrity, and availability impacts are limited because the attacker already holds a privileged role. The primary security consequence is the extension of access windows, which weakens session lifecycle controls and complicates token revocation strategies.
Root Cause
The root cause is missing or incomplete server-side input validation on the expiration parameter submitted during Host Pass creation. The application trusts client-supplied duration values rather than clamping them to a server-enforced maximum. This is a classic [CWE-1284] Improper Validation of Specified Quantity in Input weakness, where bounds checks on numeric input are absent or insufficient.
Attack Vector
An authenticated attacker with Host Pass creation privileges submits a crafted Host Pass creation request specifying an expiration duration that exceeds the configured policy limit. The application accepts the value and issues a delegated access token honoring the extended lifetime. The attacker, or any party who obtains the token, can then use it for the extended period without triggering re-issuance controls.
No verified public exploit code is available. See the GitHub CVE-2026-11596 Disclosure for vendor-published technical details.
Detection Methods for CVE-2026-11596
Indicators of Compromise
- Host Pass tokens with expiration timestamps that exceed the configured organizational maximum.
- Audit log entries for Host Pass creation events containing unusually large duration values.
- Delegated access sessions persisting beyond expected support engagement windows.
Detection Strategies
- Review ScreenConnect audit logs for HostPass creation events and compare the resulting token expiration against policy thresholds.
- Correlate token issuance events with the issuing user account and look for outliers in requested duration.
- Implement server-side or SIEM rules that flag any token with a lifetime above the documented maximum.
Monitoring Recommendations
- Forward ScreenConnect application and audit logs to a centralized logging platform for longitudinal analysis.
- Alert on repeated Host Pass creation activity from a single user account within a short time window.
- Track active delegated access tokens and revoke any whose expiration exceeds approved policy.
How to Mitigate CVE-2026-11596
Immediate Actions Required
- Upgrade ScreenConnect to version 26.2 or later, which enforces the maximum token expiration server-side.
- Audit existing Host Pass tokens and revoke any with expiration durations exceeding policy.
- Review which accounts hold Host Pass creation privileges and apply least-privilege adjustments.
Patch Information
ConnectWise addressed the issue in ScreenConnect version 26.2. Refer to the GitHub CVE-2026-11596 Disclosure for the official advisory and upgrade guidance. Apply the update across all on-premises and self-hosted ScreenConnect deployments.
Workarounds
- Restrict Host Pass creation privileges to a minimum set of trusted administrators until the patch is applied.
- Monitor and manually revoke any Host Pass tokens whose configured lifetime exceeds the intended maximum.
- Enforce shorter overall session policies at the network or identity layer to limit the value of extended tokens.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
