ConnectWise is investigating unauthorized access to some of its partners' ScreenConnect remote-support environments. Attackers used those partner consoles to push unauthorized ScreenConnect clients and a malicious toolkit called SCKit onto managed computers. ConnectWise first posted its advisory Wednesday evening, November 11, 2026, and updated it Thursday afternoon. This story came in after our Thursday, November 12 update. If your IT provider uses ScreenConnect, ask a few direct questions — and don't assume your business was hit.
ConnectWise's current assessment, which it is still validating, is that the activity may involve abuse of independent third-party extensions in the RMM+ family: Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link, and RMM+ Password Link. A vulnerability in that extension, CVE-2026-127063, is rated 9.3 (Critical) under CVSS 4.0. ConnectWise's CVE record says the extension uses a static API secret by default and that disabling it is the current mitigation, with no fixed RMM+ version announced. Huntress reported that in RMM+ versions 1.0.31 and 1.0.32, if an administrator had never configured the access key, RMM+ would accept a blank one. ConnectWise says it is assessing those findings.
What ConnectWise has confirmed
On its Trust Center advisory, ConnectWise says it identified approximately 400 partner environments with at least one of those extensions installed and disabled the extensions in cloud-hosted environments where it could. For partners who run ScreenConnect on their own servers, it says "on-premises partners should disable them immediately" and should "verify their status and avoid re-enabling or reinstalling them pending further guidance." That 400 figure "reflects environments with the extensions installed, not confirmed compromises."
On its own systems, ConnectWise writes: "At this time, we have found no evidence of a compromise of ConnectWise infrastructure or that initial access involved a ScreenConnect vulnerability." The investigation is ongoing.
Researchers report that SCKit is designed to spread from an infected computer to a technician who connects to it. ConnectWise says "the toolkit's attempted endpoint-to-technician spread technique is blocked by the fix for CVE-2026-84869, released in ScreenConnect client version 26.6.5 on September 8, 2026," and that "all partners should verify that their ScreenConnect technician clients are running version 26.6.5 or later." It adds: "Updating a cloud console does not automatically update technician clients." That does not remove an existing compromise. Researchers say they have not observed that spread succeed.
Huntress, counting only its own customers, said attackers used Run commands on cloud-hosted panels to install rogue clients on at least 288 managed endpoints across 48 organizations starting November 11.
Why this matters to small businesses
Most small businesses never log into ScreenConnect. Their IT provider does. ConnectWise disabled specific third-party extensions; it did not take the platform offline, so remote help may still be available, though support could be slower while providers disable extensions, update technician software, and check machines. This comes in the same month that N-able took N-central offline after Able2Shell zero-days were published, and after a separate ConnectWise Cloud Backup service interruption.
What to do now
- Ask your IT provider whether they use ScreenConnect, and whether any of the RMM+ family extensions listed above are installed. If they are, ask whether those extensions have been disabled, especially if the provider runs ScreenConnect on its own servers.
- Ask whether their ScreenConnect technician clients are on version 26.6.5 or later. Updating the cloud console does not automatically update those clients.
- Ask them to check your computers for unexpected remote-access software, including an unauthorized second ScreenConnect client, as Huntress recommends. If you notice a new remote-access program you did not approve, call a number you already have. Don't approve a surprise remote session.
- Ask how you should reach them if something looks wrong this week, and expect some delays.
- Watch for phishing that pretends to be your IT provider or ConnectWise. Don't share a password, code, or remote-access approval in response to a surprise request.
What we are not claiming: We are not saying your business was affected. No public source we reviewed named a victim in Georgia, Tennessee, Alabama, or New York, or named a threat actor. ConnectWise's figure of approximately 400 partner environments is, in the company's words, "not confirmed compromises." Huntress's count of at least 288 endpoints across 48 organizations refers to Huntress customers only. We are not claiming that data was stolen, that ransomware was involved, or that ConnectWise's own infrastructure was breached. The investigation is ongoing.
The takeaway for IT decision-makers
If your provider uses ScreenConnect, ask today whether any RMM+ family extensions are installed and disabled, whether technician clients are on the version ConnectWise says blocks the attempted spread, and whether your machines have been checked for unexpected remote-access software. Keep working, use a phone number you already have, and treat surprise remote-access prompts with caution. If you'd like help asking those questions, Brotherly Technology can help.
Sources
- ConnectWise Trust Center: Advisories (ScreenConnect security advisory; latest update Nov 12, 2026, 18:45 UTC / 1:45 p.m. ET; checked 8:16–8:25 a.m. ET, Nov 13, 2026)
- ConnectWise: ScreenConnect security update: Guidance for partners
- ConnectWise Advisories: CVE-2026-127063
- Huntress: SCKit Worm Installs Rogue ScreenConnect Clients and Session Cookie Relays Across Hundreds of Endpoints
- BleepingComputer: New worm-like 'SCKit' malware targets MSPs in ScreenConnect attacks
- Cybersecurity Dive: ConnectWise disables third-party extensions as it probes cyberattack targeting ScreenConnect users