{"id":"CVE-2026-127063","kind":"vulnerability","aliases":["CVE-2026-127063"],"related":[],"title":"RMM+ extension for ScreenConnect accepts a blank or default API key, and is linked to a mass attack on ScreenConnect panels","description":"The\nthird-party RMM+ extension for ConnectWise ScreenConnect uses a static API\nsecret by default. The value can be changed by an administrator; however,\nenvironments retaining the default value may allow unauthorized access to\nextension API functionality, including the ability to send commands to managed\nagents. This issue is specific to the third-party extension and does not affect\nthe ScreenConnect server or client.\n\n\n\n\n\nScope: This issue affects the third-party RMM+\nextension for ConnectWise ScreenConnect. Deployments without the extension are\nnot affected. ScreenConnect server or client software are not impacted.","summary":"RMM+ is a third-party ScreenConnect extension whose API runs commands on managed agents and skips ScreenConnect logins and MFA. Huntress reports versions 1.0.31 and 1.0.32 accept a blank access key when the admin never set one. Huntress ties this to attacks on 11 Nov 2026 that put rogue ScreenConnect clients on at least 288 endpoints. ConnectWise has disabled the RMM+ family of extensions in about 400 cloud environments as a precaution. Its advisory does not name a root cause or a fix.","severity":"critical","cvss":9.3,"epss":null,"exploited":true,"exploited_at":null,"products":[{"name":"RMM+ extension for ScreenConnect","fixed":[],"affected":"1.0.31, 1.0.32 (per Huntress; ConnectWise lists no versions)","ecosystem":"vendor"}],"ecosystems":[],"tags":["exploited-in-wild","remote-monitoring","rmm","rmm-plus","screenconnect","self-hosted","vendor"],"not_affected_if":["access-key-configured","extension-disabled","extension-not-installed","secret-changed-from-default"],"how_to_check":"- In ScreenConnect Admin > Extensions, look for RMM+, RMM Plus, Labtech Plus, RMM Plus Password Link or RMM+ Password Link. If present and enabled, disable it (on-premises installs must do this by hand).\n- Check the extension version (Huntress: 1.0.31 and 1.0.32 are affected) and whether its access key setting is empty or still a default. If it is, treat the API as open.\n- Review Run Command and Toolbox history for mass commands you did not start, and look for a second ScreenConnect client on endpoints.\n- Look for the ConnectWise IoCs: C:\\ProgramData\\RelayTrap\\, a TrapWatch scheduled task, %TEMP%\\sckit-*, and the domains and IPs in the advisory.","fix":null,"status":"open","published_at":"2026-11-12T18:17:39+00:00","first_seen_at":"2026-11-12T18:40:39+00:00","triaged_at":"2026-11-12T18:42:36+00:00","updated_at":"2026-11-12T18:49:23+00:00","category":"vendor","confidence":0.75,"triage":{"at":"2026-11-12T18:42:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"RMM+ extension for ScreenConnect ships a static default API secret","impact":"high","summary":"The third-party RMM+ extension for ConnectWise ScreenConnect uses a static API secret by default. Environments that keep the default may let an attacker reach extension API functions, including sending commands to managed agents.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["screenconnect","rmm-plus","self-hosted","remote-monitoring"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker sends commands to managed agents through extension API","analyst_note":"Find the vendor advisory for RMM+ to confirm the fixed version, how to change the API secret, and whether the API is reachable from the internet.","how_to_check":"- Check whether the RMM+ extension is installed on the ScreenConnect server\n- Check whether the extension's API secret is still the default value (unknown how the sources say to read it)","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["extension-not-installed","secret-changed-from-default"],"who_is_affected":"Only deployments that have the third-party RMM+ extension installed are exposed; the ScreenConnect server and client themselves are not affected. Exposure requires the API secret to still be the default, since administrators can change it. Teams without the extension can skip this.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000728,"input_tokens":4641,"output_tokens":527,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the vendor advisory for RMM+ to confirm the fixed version, how to change the API secret, and whether the API is reachable from the internet.","search":"'-127063':24A,27A '-2026':23A,26A '1.0.31':72B '1.0.32':74B '11':92B '2026':94B '288':103B '400':115B 'abil':172C 'accept':5A,75B 'access':78B,165C 'admin':82B 'administr':155C 'advisori':122B 'affect':192C,201C,217C 'agent':62B,178C 'allow':163C 'api':10A,57B,144C,168C 'attack':18A,90B 'blank':7A,77B 'caus':128B 'chang':152C 'client':99B,197C,221C 'cloud':116B 'command':59B,175C 'connectwis':105B,139C,209C 'cve':22A,25A 'default':9A,147C,160C 'deploy':211C 'disabl':107B 'endpoint':104B 'environ':117B,157C 'exploit':33B 'exploited-in-wild':32B 'extens':2A,55B,112B,137C,167C,188C,207C,214C 'extension':29A 'famili':110B 'fix':131B 'for':30A 'function':169C 'host':46B 'howev':156C 'huntress':69B,86B 'impact':225C 'includ':170C 'issu':180C,200C 'key':11A,79B 'least':102B 'link':14A 'login':66B 'manag':61B,177C 'mass':17A 'may':162C 'mfa':68B 'monitor':38B 'name':125B 'never':83B 'nov':93B 'one':85B 'panel':21A 'parti':53B,135C,187C,205C 'plus':42B 'precaut':120B 'put':96B 'remot':37B 'remote-monitor':36B 'report':70B 'retain':158C 'rmm':1A,28A,39B,41B,48B,109B,136C,206C 'rmm-plus':40B 'rogu':97B 'root':127B 'run':58B 'scope':198C 'screenconnect':4A,20A,31A,43B,54B,65B,98B,140C,194C,210C,218C 'secret':145C 'self':45B 'self-host':44B 'send':174C 'server':195C,219C 'set':84B 'skip':64B 'softwar':222C 'specif':182C 'static':143C 'third':52B,134C,186C,204C 'third-parti':51B,133C,185C,203C 'tie':87B 'unauthor':164C 'use':141C 'valu':149C,161C 'vendor':47B 'version':71B 'whose':56B 'wild':35B 'without':212C","nicknames":[],"mitigations":[],"who_affected":"Teams running ScreenConnect with the third-party RMM+ family extensions installed. That is mainly MSPs and IT providers, both cloud-hosted and on-premises. The API sits behind a shared access key, so exposure is highest where the key was never set or left at its default. Huntress names versions 1.0.31 and 1.0.32. Teams without these extensions can skip this. ConnectWise says it found no flaw in ScreenConnect itself.","tier":"A","verified":{"mitigations":{"at":"2026-11-12T18:43:51Z","by":"analyst","doc":"https://www.connectwise.com/company/trust/advisories","run_id":3761}},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["extensionforscreenconnect","rmmextensionforscreenconnect"],"ptokens":["extension","for","rmm","screenconnect"],"labels":["critical","exploitedinwild","remotemonitoring","rmm","rmmplus","screenconnect","selfhosted","vendor"],"campaign_type":null,"search_a":"'-127063':24A,27A '-2026':23A,26A 'accept':5A 'api':10A 'attack':18A 'blank':7A 'cve':22A,25A 'default':9A 'extens':2A 'extension':29A 'for':30A 'key':11A 'link':14A 'mass':17A 'panel':21A 'rmm':1A,28A 'screenconnect':4A,20A,31A","search_b":"'1.0.31':72B '1.0.32':74B '11':92B '2026':94B '288':103B '400':115B 'accept':75B 'access':78B 'admin':82B 'advisori':122B 'agent':62B 'api':57B 'attack':90B 'blank':77B 'caus':128B 'client':99B 'cloud':116B 'command':59B 'connectwis':105B 'disabl':107B 'endpoint':104B 'environ':117B 'exploit':33B 'exploited-in-wild':32B 'extens':55B,112B 'famili':110B 'fix':131B 'host':46B 'huntress':69B,86B 'key':79B 'least':102B 'login':66B 'manag':61B 'mfa':68B 'monitor':38B 'name':125B 'never':83B 'nov':93B 'one':85B 'parti':53B 'plus':42B 'precaut':120B 'put':96B 'remot':37B 'remote-monitor':36B 'report':70B 'rmm':39B,41B,48B,109B 'rmm-plus':40B 'rogu':97B 'root':127B 'run':58B 'screenconnect':43B,54B,65B,98B 'self':45B 'self-host':44B 'set':84B 'skip':64B 'third':52B 'third-parti':51B 'tie':87B 'vendor':47B 'version':71B 'whose':56B 'wild':35B","search_c":"'abil':172C 'access':165C 'administr':155C 'affect':192C,201C,217C 'agent':178C 'allow':163C 'api':144C,168C 'chang':152C 'client':197C,221C 'command':175C 'connectwis':139C,209C 'default':147C,160C 'deploy':211C 'environ':157C 'extens':137C,167C,188C,207C,214C 'function':169C 'howev':156C 'impact':225C 'includ':170C 'issu':180C,200C 'manag':177C 'may':162C 'parti':135C,187C,205C 'retain':158C 'rmm':136C,206C 'scope':198C 'screenconnect':140C,194C,210C,218C 'secret':145C 'send':174C 'server':195C,219C 'softwar':222C 'specif':182C 'static':143C 'third':134C,186C,204C 'third-parti':133C,185C,203C 'unauthor':164C 'use':141C 'valu':149C,161C 'without':212C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T02:00:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"7d616e1a-3288-43b1-a0dd-0a65d3e70a49","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-127063","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127063","severity":null,"published_at":"2026-11-12T18:17:39+00:00","modified_at":"2026-11-12T18:17:39+00:00","first_seen_at":"2026-11-12T18:40:39+00:00","fetched_at":"2026-11-12T18:40:39+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-127063:3761","url":null,"severity":null,"published_at":"2026-11-12T18:43:51+00:00","modified_at":"2026-11-12T18:43:51+00:00","first_seen_at":"2026-11-12T18:43:51+00:00","fetched_at":"2026-11-12T18:43:51+00:00","note":"ConnectWise advisory (11/12 02:45 UTC) says disable the RMM+ family of extensions, do not re-enable or reinstall, and investigate. It names no fixed version and no versions. Huntress names 1.0.31/1.0.32 and a blank default key, whereas NVD says a static default secret, so the two differ. Huntress calls the link to the attack 'seems', and ConnectWise only suspects it. I marked only mitigations verified. Reachability from the internet is not stated by the vendor. Tier B looks too low given the active campaign (CVE-2026-84869 is a separate September ScreenConnect issue)."}],"documents":[{"id":42462,"url":"https://www.connectwise.com/company/trust/advisories","title":"ConnectWise Trust Center: ScreenConnect precautionary extension disabling and partner guidance","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"mitigation","confidence":null,"note":null},{"id":132791,"url":"https://www.huntress.com/blog/sckit-worm-rogue-screenconnect","title":"Huntress: SCKit worm installs rogue ScreenConnect clients","kind":"blog","source":"blog","publisher":null,"text":"SCKit Worm Installs Rogue ScreenConnect Clients and Session Cookie Relays Across Hundreds of Endpoints\n\nAttackers are using cloud-hosted ScreenConnect panels to install rogue clients on hundreds of managed endpoints.","published_at":"2026-11-12T02:00:00+00:00","relation":"describes","confidence":null,"note":null},{"id":137500,"url":"https://www.securityweek.com/hackers-deploy-malware-in-fresh-screenconnect-campaign/","title":"SecurityWeek: Hackers Deploy Malware in Fresh ScreenConnect Campaign","kind":"blog","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"discussion","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}