--- id: "CVE-2026-127063" page: "https://infrastack.ai/live/CVE-2026-127063" kind: "vulnerability" aliases: ["CVE-2026-127063"] title: "RMM+ extension for ScreenConnect accepts a blank or default API key, and is linked to a mass attack on ScreenConnect panels" severity: "critical" cvss: 9.3 epss: null exploited: true status: "open" category: "vendor" products: [{"name": "RMM+ extension for ScreenConnect", "fixed": [], "affected": "1.0.31, 1.0.32 (per Huntress; ConnectWise lists no versions)", "ecosystem": "vendor"}] ecosystems: [] tags: ["exploited-in-wild", "remote-monitoring", "rmm", "rmm-plus", "screenconnect", "self-hosted", "vendor"] not_affected_if: ["access-key-configured", "extension-disabled", "extension-not-installed", "secret-changed-from-default"] published_at: "2026-11-12T18:17:39+00:00" first_seen_at: "2026-11-12T18:40:39+00:00" updated_at: "2026-11-12T18:49:23+00:00" sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-127063", "first_seen_at": "2026-11-12T18:40:39+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-12T18:43:51+00:00"}] exploit_sources: [] --- # RMM+ extension for ScreenConnect accepts a blank or default API key, and is linked to a mass attack on ScreenConnect panels Link for people: https://infrastack.ai/live/CVE-2026-127063 (this .md is for agents) RMM+ is a third-party ScreenConnect extension whose API runs commands on managed agents and skips ScreenConnect logins and MFA. Huntress reports versions 1.0.31 and 1.0.32 accept a blank access key when the admin never set one. Huntress ties this to attacks on 11 Nov 2026 that put rogue ScreenConnect clients on at least 288 endpoints. ConnectWise has disabled the RMM+ family of extensions in about 400 cloud environments as a precaution. Its advisory does not name a root cause or a fix. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:RMM+ extension for ScreenConnect affected 1.0.31, 1.0.32 (per Huntress; ConnectWise lists no versions) fixed no fixed version listed ## How to check - In ScreenConnect Admin > Extensions, look for RMM+, RMM Plus, Labtech Plus, RMM Plus Password Link or RMM+ Password Link. If present and enabled, disable it (on-premises installs must do this by hand). - Check the extension version (Huntress: 1.0.31 and 1.0.32 are affected) and whether its access key setting is empty or still a default. If it is, treat the API as open. - Review Run Command and Toolbox history for mass commands you did not start, and look for a second ScreenConnect client on endpoints. - Look for the ConnectWise IoCs: C:\ProgramData\RelayTrap\, a TrapWatch scheduled task, %TEMP%\sckit-*, and the domains and IPs in the advisory. ## Timeline - 2026-11-12T18:40:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-127063 - 2026-11-12T18:43:51+00:00 analyst — ConnectWise advisory (11/12 02:45 UTC) says disable the RMM+ family of extensions, do not re-enable or reinstall, and investigate. It names no fixed version and no versions. Huntress names 1.0.31/1.0.32 and a blank default key, whereas NVD says a static default secret, so the two differ. Huntress calls the link to the attack 'seems', and ConnectWise only suspects it. I marked only mitigations verified. Reachability from the internet is not stated by the vendor. Tier B looks too low given the active campaign (CVE-2026-84869 is a separate September ScreenConnect issue). ## Documents - [describes] Huntress: SCKit worm installs rogue ScreenConnect clients https://www.huntress.com/blog/sckit-worm-rogue-screenconnect - [discussion] SecurityWeek: Hackers Deploy Malware in Fresh ScreenConnect Campaign https://www.securityweek.com/hackers-deploy-malware-in-fresh-screenconnect-campaign/ - [mitigation] ConnectWise Trust Center: ScreenConnect precautionary extension disabling and partner guidance https://www.connectwise.com/company/trust/advisories ## From the sources The third-party RMM+ extension for ConnectWise ScreenConnect uses a static API secret by default. The value can be changed by an administrator; however, environments retaining the default value may allow unauthorized access to extension API functionality, including the ability to send commands to managed agents. This issue is specific to the third-party extension and does not affect the ScreenConnect server or client. Scope: This issue affects the third-party RMM+ extension for ConnectWise ScreenConnect. Deployments without the extension are not affected. ScreenConnect server or client software are not impacted. --- _Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_