CVE-2026-127063: Critical severity vulnerability
The third-party RMM+ extension for ConnectWise ScreenConnect uses a static API secret by default. The value can be changed by an administrator; however, environments retaining the default value may allow unauthorized access to extension API functionality, including the ability to send commands to managed agents. This issue is specific to the third-party extension and does not affect the ScreenConnect server or client.
Scope: This issue affects the third-party RMM+ extension for ConnectWise ScreenConnect. Deployments without the extension are not affected. ScreenConnect server or client software are not impacted.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable the RMM+ extension immediately and do not re-enable or reinstall it pending further guidance.
third-party RMM+ extension for ConnectWise ScreenConnect extension status = disabled
Event History
Frequently Asked Questions
Which deployments are affected?
Only deployments using the third-party RMM+ extension for ConnectWise ScreenConnect are affected. ScreenConnect deployments without this extension, including the ScreenConnect server and client software themselves, are not impacted.
What must an attacker do to exploit the issue?
An attacker can target an environment where the RMM+ extension still uses its default static API secret. No authentication or user interaction is indicated in the provided severity vector.
What could an attacker do with successful access?
Unauthorized access to the extension API may allow an attacker to use extension functionality, including sending commands to managed agents.
What should administrators do if they use the extension?
Administrators should change the RMM+ extension API secret from its default static value. Environments that retain the default value may be exposed.