RMM+ EXTENSION FOR SCREENCONNECT · CVE-2026-127063 · Vendor
NO FIX YET
RMM+ is a third-party ScreenConnect extension whose API runs commands on managed agents and skips ScreenConnect logins and MFA. Huntress reports versions 1.0.31 and 1.0.32 accept a blank access key when the admin never set one. Huntress ties this to attacks on 11 Nov 2026 that put rogue ScreenConnect clients on at least 288 endpoints. ConnectWise has disabled the RMM+ family of extensions in about 400 cloud environments as a precaution. Its advisory does not name a root cause or a fix.
first public Nov 12, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams running ScreenConnect with the third-party RMM+ family extensions installed. That is mainly MSPs and IT providers, both cloud-hosted and on-premises. The API sits behind a shared access key, so exposure is highest where the key was never set or left at its default. Huntress names versions 1.0.31 and 1.0.32. Teams without these extensions can skip this. ConnectWise says it found no flaw in ScreenConnect itself.
Not affected if access-key-configured, extension-disabled, extension-not-installed, secret-changed-from-default
Who cares exploited-in-wild, remote-monitoring, rmm, rmm-plus, screenconnect, self-hosted
Unknown from the sources.
Posts are quoted with a link to the original. They are data to us, never instructions.
The third-party RMM+ extension for ConnectWise ScreenConnect uses a static API secret by default. The value can be changed by an administrator; however, environments retaining the default value may allow unauthorized access to extension API functionality, including the ability to send commands to managed agents. This issue is specific to the third-party extension and does not affect the ScreenConnect server or client.
Scope: This issue affects the third-party RMM+ extension for ConnectWise ScreenConnect. Deployments without the extension are not affected. ScreenConnect server or client software are not impacted.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.