ScreenConnect RMM+ extension flaw: 288 PCs hit and what administrators should do now

Attackers used a flaw in a third-party add-on for ConnectWise ScreenConnect to push malware onto at least 288 computers at 48 organisations on Wednesday 11 November 2026, according to security firm Huntress. ConnectWise has since switched off five related extensions in the cloud environments it hosts and told customers who run their own servers to disable them immediately.

The add-on at the centre of the incident is the ScreenConnect RMM+ extension, a tool made by an independent developer, not by ConnectWise. ConnectWise says in its security advisory that it has found no evidence of a vulnerability in ScreenConnect itself or of a compromise of its own infrastructure.

This article is a defensive summary for administrators. It stays at the level of the vendor advisory and the Huntress report and does not describe how to carry out the attack.

What happened on 11 November 2026?

Huntress says it first noticed suspicious activity at about 17:47 UTC on 11 November 2026 across several ScreenConnect environments. Someone was using ScreenConnect's remote command feature to install unauthorised ScreenConnect clients, along with a malware toolkit, on machines managed by IT service providers.

The spread was fast. Huntress reports that all 288 affected hosts were hit within about 90 minutes, and roughly a third of them in the first 10 minutes. SecurityWeek, citing Huntress, puts the number of compromised managed service providers (MSPs) at six or more.

Those figures cover only customers that Huntress protects. The Register reports that Huntress believes more MSPs may be affected.

ConnectWise published its advisory at 22:45 UTC the same day and updated it twice on 12 November 2026, at 02:45 and 18:45 UTC. The investigation is described as ongoing. The latest version says a CVE identifier, CVE-2026-127063, has been assigned to the third-party extension issue.

Detail	What is known	Source
Date of the activity	11 November 2026, from about 17:47 UTC	Huntress
Machines affected	At least 288 endpoints at 48 organisations	Huntress
Service providers affected	At least six MSPs	Huntress, via SecurityWeek
Extensions disabled	Five third-party extensions	ConnectWise
Environments with the extensions	About 400	ConnectWise
Flawed versions identified	RMM+ 1.0.31 and 1.0.32	Huntress

Which extensions are affected?

ConnectWise's advisory names five independent third-party extensions that it disabled as a precaution:

• Labtech Plus
• RMM Plus
• RMM+
• RMM Plus Password Link
• RMM+ Password Link

ConnectWise says about 400 partner environments had at least one of these installed. It stresses that the presence of an extension alone does not establish that an environment was compromised.

Huntress describes RMM+ as an extension that lets another management tool control ScreenConnect sessions without a technician using the ScreenConnect console. According to Huntress, most installations it saw were legitimate, typically added for a project and then left in place.

What is the flaw?

Huntress says versions 1.0.31 and 1.0.32 of RMM+ had an authentication flaw. The extension relies on a shared access key set by the administrator, and where that key had never been configured the extension was not properly protected.

Because the extension works outside ScreenConnect's normal user accounts, roles and multi-factor authentication, Huntress says commands reached endpoints across several ScreenConnect instances within minutes with no matching login activity.

ConnectWise's wording is more cautious. Huntress says the activity "seems to be related" to RMM+, while the vendor's advisory treats the cause and scope as still under investigation.

Does running the latest ScreenConnect version protect you?

Not for the extension problem. Huntress says the affected environments were running current ScreenConnect releases, 26.6.6.9747 and 26.7.6.9783. That fits with ConnectWise's statement that the core product was not at fault: the weakness sat in an add-on, so updating ScreenConnect does not remove it.

Technician clients are a separate matter. In its 12 November 18:45 UTC update, ConnectWise says the technician-workstation spread technique Huntress described is blocked by the CVE-2026-84869 fix in ScreenConnect client 26.6.5 or later, and it warns that updating a cloud console does not automatically update technician clients. It asks partners to verify each workstation's client version and, as a temporary measure, to disable Transfer Files where it is not needed.

That flaw is the one fixed in September 2026. That bug, tracked as CVE-2026-84869 with a severity score of 9.9 out of 10, was in the ScreenConnect client and was patched in version 26.6.5, SecurityWeek reported on 14 September 2026.

What does the malware do?

Huntress calls the toolkit SCKit and describes it as a package of 16 files. At a high level, it installs a second, attacker-controlled ScreenConnect client so the intruders keep remote access even if the legitimate connection is shut down.

The more worrying design feature is aimed at the people who respond. Huntress says the toolkit is built to wait for a technician to connect to an infected machine through ScreenConnect, then try to reach the technician's own workstation and steal session cookies that could open the way to other customers.

Huntress adds an important limit: it has not seen that part work. The firm says the console takeover attempt failed in every recovered host log it had checked, and it has not observed successful spread from an infected endpoint to a technician's workstation.

What should administrators do now?

The guidance below combines the ConnectWise advisory and the Huntress report.

1. Disable the five extensions. ConnectWise has done this where it could in hosted environments. On-premises partners must do it themselves, and ConnectWise says not to re-enable or reinstall them pending further guidance.
2. Check that they are really off. ConnectWise asks all partners to verify the listed extensions are disabled.
3. Do not use ScreenConnect to investigate a suspect machine. Both ConnectWise and Huntress advise using separate security tooling. If a technician has already connected to a suspect host, Huntress says to treat that workstation as potentially exposed.
4. Preserve the logs. ConnectWise lists authentication, extension, administrative, Run Command and Toolbox logs.
5. Review activity. Huntress recommends checking Run Command and Toolbox history for mass executions nobody on the team started, and looking for a second, unauthorised ScreenConnect client on endpoints.
6. Revoke sessions and reset credentials. ConnectWise advises revoking active ScreenConnect and identity-provider sessions, resetting credentials and enforcing multi-factor authentication.
7. Keep affected hosts isolated until they are clean. Huntress warns that isolation alone does not remove the malware and that some systems were reinfected shortly after isolation ended.

ConnectWise also asks partners to stay on heightened alert even if the extensions were never installed.

Analysis: why add-ons are the weak point

This section is our own analysis, not reporting from the sources.

Remote support tools are attractive to attackers because one login can reach thousands of machines. Vendors and customers have responded by hardening the front door with single sign-on and multi-factor authentication. An extension that accepts commands through its own key, outside those controls, is a side door that the same checks never see.

The Huntress observation that many installations were added for a one-off project and then forgotten points to a wider housekeeping problem. An unused integration still carries risk, and its settings are rarely revisited after the project ends.

For organisations that outsource IT, the practical question is one for the supplier: which remote access tools and add-ons are installed on our machines, and who reviews them? It is the kind of supply chain exposure we flagged in our earlier piece on cybersecurity challenges and solutions.

Two things remain unknown as of ConnectWise's 18:45 UTC update on 12 November 2026: who is behind the campaign, and how many organisations outside Huntress's customer base were hit. ConnectWise says it is still validating the initial access route, so the picture may change as its investigation continues.

Sources

• ConnectWise Trust Center: security advisories
• Huntress: SCKit Worm Installs Rogue ScreenConnect Clients and Session Cookie Relays Across Hundreds of Endpoints
• The Register: Hackers exploiting ScreenConnect plugin flaw to spread malware across hundreds of PCs
• SecurityWeek: Hackers Deploy Malware in Fresh ScreenConnect Campaign
• SecurityWeek: ConnectWise Patches ScreenConnect Vulnerability Exploited in Worm-Like Attacks