# CVE-2026-127063

November 12, 2026

---

## Description

The third-party RMM+ extension for ConnectWise ScreenConnect uses a static API secret by default. The value can be changed by an administrator; however, environments retaining the default value may allow unauthorized access to extension API functionality, including the ability to send commands to managed agents. This issue is specific to the third-party extension and does not affect the ScreenConnect server or client.

---

## Scope

This issue affects the third-party RMM+ extension for ConnectWise ScreenConnect. Deployments without the extension are not affected. ScreenConnect server or client software are not impacted.

---

## CVSS 4.0

9.3 (Critical) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

---

## Common Weakness Enumeration

CWE-1392: Use of Default Credentials

---

## Details

The third-party RMM+ extension for ConnectWise ScreenConnect uses a configurable API secret to control access to its functions. If the default value is retained, unauthorized requests may be accepted, including requests to send commands to managed agents. ConnectWise has disabled the extension where it can and advises on-premises partners to disable it pending further guidance. This issue is limited to RMM+ and does not affect ScreenConnect server or client software.

---

## Resolution

### Cloud

* No action required. ConnectWise disabled and removed the affected third-party RMM+ extensions from cloud-hosted ScreenConnect environments.

### On-Premise

* Disable the RMM+ extension immediately and verify that it remains disabled.
* Do not re-enable or reinstall it pending further guidance.

---

## Affected Products

- DataComm RMM+ extension for ConnectWise ScreenConnect

---

## Fixed Version

- No fixed RMM+ version has been announced. Disabling the extension is the current mitigation.

---

## References

- https://www.cve.org/CVERecord?id=CVE-2026-127063
- https://www.connectwise.com/company/trust/advisories