{"id":"CVE-2026-11596","aliases":["EUVD-2026-36079","GHSA-ff2m-7qh4-77hp"],"status":"published","title":"In ScreenConnect™ versions prior to 26.2, input\nvalidation within the Host Pass creation...","description":"In ScreenConnect™ versions prior to 26.2, input\nvalidation within the Host Pass creation functionality could allow an\nauthenticated user with Host Pass creation privileges the ability to specify a\ntoken expiration duration beyond the intended maximum when generating delegated\naccess tokens.","severity":{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00237,"percentile":0.14828,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-1284"],"published":"2026-06-10T17:15:07Z","modified":"2026-10-26T11:10:00Z","products":[{"vendor":"connectwise","product":"screenconnect"}],"references":[{"url":"https://github.com/ConnectWise-Advisories/Disclosures/tree/main/CVE-2026-11596","tags":["Patch","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11596"},{"url":"https://github.com/advisories/GHSA-ff2m-7qh4-77hp"}],"sources":{"cve":[{"id":"CVE-2026-11596","description":"In ScreenConnect™ versions prior to 26.2, input\nvalidation within the Host Pass creation functionality could allow an\nauthenticated user with Host Pass creation privileges the ability to specify a\ntoken expiration duration beyond the intended maximum when generating delegated\naccess tokens.","status":"published","published":"2026-06-10T17:15:07.586Z","modified":"2026-06-10T18:18:41.537Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-1284"],"updated_at":"2026-11-02T14:20:04.463704Z"}],"euvd":[{"id":"EUVD-2026-36079","description":"In ScreenConnect™ versions prior to 26.2, input\nvalidation within the Host Pass creation functionality could allow an\nauthenticated user with Host Pass creation privileges the ability to specify a\ntoken expiration duration beyond the intended maximum when generating delegated\naccess tokens.","status":"published","published":"2026-06-10T17:15:07Z","modified":"2026-06-10T18:18:41Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T18:20:44.937217Z"}],"ghsa":[{"id":"GHSA-ff2m-7qh4-77hp","title":"In ScreenConnect™ versions prior to 26.2, input\nvalidation within the Host Pass creation...","description":"In ScreenConnect™ versions prior to 26.2, input\nvalidation within the Host Pass creation functionality could allow an\nauthenticated user with Host Pass creation privileges the ability to specify a\ntoken expiration duration beyond the intended maximum when generating delegated\naccess tokens.","status":"published","published":"2026-06-10T18:31:46Z","modified":"2026-06-10T18:31:53Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-1284"],"updated_at":"2026-11-02T15:08:43.963781Z"}],"nvd":[{"id":"CVE-2026-11596","description":"In ScreenConnect™ versions prior to 26.2, input\nvalidation within the Host Pass creation functionality could allow an\nauthenticated user with Host Pass creation privileges the ability to specify a\ntoken expiration duration beyond the intended maximum when generating delegated\naccess tokens.","status":"published","published":"2026-06-10T18:16:40.113Z","modified":"2026-10-26T11:10:00.157Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-1284"],"updated_at":"2026-11-02T14:12:23.485267Z"}]}}