Top-Secured cyber watch: independent analysis based on the sources listed below. Top-Secured is not affiliated with the companies mentioned and will never ask you for your bank details or passwords.
ConnectWise is investigating unauthorised access to partner ScreenConnect environments, which it links to RMM+, a third-party extension whose API accepts a default secret (CVE-2026-127063, CVSS 9.3). The extensions have been disabled in the cloud; on-premises servers must be handled by their administrators.
What happened
On 11 November 2026, ConnectWise warned that attackers had gained unauthorised access to some partner environments of ScreenConnect, its remote support tool widely used by IT service providers (MSPs), and had installed unauthorised remote access software on their customers’ machines. According to Huntress, which saw the activity start at about 17:47 UTC, at least 288 endpoints in 48 of its customer organisations were hit within roughly 90 minutes.
ConnectWise says it sees no sign that its own infrastructure was compromised and that initial access did not rely on a ScreenConnect flaw. Its assessment points to RMM+, an extension developed by a third party. Its API is protected by a secret that is static by default: installations that kept it may accept unauthenticated requests, including commands sent to managed endpoints. The weakness is tracked as CVE-2026-127063 (CVSS 4.0: 9.3) and no fixed version exists yet.
How the attackers operated
According to Huntress, the attackers used the Run Command feature of cloud-hosted ScreenConnect consoles to push commands as SYSTEM, with no matching login in the logs. They deployed a toolkit dubbed SCKit, which installs a second ScreenConnect client under their control, a scheduled task named TrapWatch and a RelayTrap folder under ProgramData, and tries to steal session cookies. Code meant to spread to technicians’ workstations was found, but Huntress has not seen it succeed. About 400 partner environments had an RMM+ family extension installed; ConnectWise stresses that this alone does not mean they were compromised.
What to do now
- Disable the extensions Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link and RMM+ Password Link. ConnectWise has done it in the cloud; on-premises servers are up to their administrators.
- Update technician clients to 26.6.5 or later, which block the spread technique (CVE-2026-84869). Updating the cloud console does not update them.
- Revoke all ScreenConnect web sessions and identity provider sessions, reset credentials and enforce MFA: a password change alone does not close open sessions.
- Look for traces: Run Command history you did not start, a second ScreenConnect client, the TrapWatch task, the RelayTrap folder, connections to 185.99.255[.]28 or 155.94.150[.]39.
- Do not investigate a suspicious machine through ScreenConnect: use another channel, as Huntress advises.
- If a provider manages your machines, ask them in writing whether they use these extensions and what they checked.
Our take
A plug-in on a remote management console inherits its power over every managed machine: it deserves the same scrutiny as the console itself. Keep an inventory of installed extensions, remove the ones you do not use and never leave a default secret in place.
Sources
- ConnectWise Trust Center — ScreenConnect security advisory: precautionary extension disabling and partner guidance
- ConnectWise Advisories (GitHub) — CVE-2026-127063
- Huntress — SCKit worm and rogue ScreenConnect clients
- The Record — ConnectWise investigates ScreenConnect breaches after reports of incidents at nearly 50 organizations
How we choose, verify and write our analyses →
The way in was a third party. Check what your suppliers expose publicly — no intrusion, public information only:
Worried your servers are exposed? Our team audits, patches and monitors Linux and cloud infrastructure 24/7.
Talk to an expert Our managed server services →
