ConnectWise Warns of Rogue ScreenConnect Deployments
ConnectWise is investigating unauthorised access to some partners’ ScreenConnect environments and reports that attackers installed remote-access software on customer devices. In its first public notice, issued at 22:45 UTC on 11 November, the company said it had yet to establish the initial access route or the full scope of the incident. ConnectWise’s original advisory
Check which extensions are enabled
ConnectWise identified about 400 partner environments with at least one of five independent extensions that might be associated with the activity. It disabled the extensions as a precaution where it could. The list covers Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link and RMM+ Password Link. Their presence alone does not establish compromise. On-premises operators should check the list against their own installations and disable any of the five still active pending further guidance. ConnectWise’s extension guidance
The vendor has also received reports of possible risk to technician workstations during interactive connections to affected devices. Use separate security tooling to investigate suspected endpoints. Preserve authentication, extension installation and Run Command records, and revoke suspicious administrative sessions from a trusted workstation. Check for additional remote-access clients even after the extension has been disabled. ConnectWise’s incident-response guidance
Update, 12 November 2026
Huntress observed attackers using commands from cloud-hosted ScreenConnect panels to install rogue clients and a toolkit it calls SCKit. It counted at least 288 affected hosts across 48 organisations in its own telemetry. The researchers found that the toolkit tried to spread back through a technician’s support session, but had not observed that technique succeed. The earlier ScreenConnect client fix in 26.6.5 blocks that route, according to ConnectWise. Verify the version on technician workstations even if the console is cloud-hosted. Huntress’s investigation · CVE-2026-84869 · ConnectWise’s client bulletin · BlackTree’s September coverage
ConnectWise assigned a separate CVE to the use of a default API secret in the third-party DataComm RMM+ extension. Huntress also reported that two tested versions accepted an empty access key when one had not been set. ConnectWise continued to investigate the initial access route and said it had found no evidence that its own infrastructure was compromised. The client update and extension disablement address different parts of the response. Review both before returning affected devices to service. CVE-2026-127063 · ConnectWise’s 12 November assessment
