CVE-2026-127063

Description

The third-party RMM+ extension for ConnectWise ScreenConnect uses a static API secret by default. The value can be changed by an administrator; however, environments retaining the default value may allow unauthorized access to extension API functionality, including the ability to send commands to managed agents. This issue is specific to the third-party extension and does not affect the ScreenConnect server or client. Scope: This issue affects the third-party RMM+ extension for ConnectWise ScreenConnect. Deployments without the extension are not affected. ScreenConnect server or client software are not impacted.

Severity scores

Each score is shown as its source gave it. They are not averaged or merged.

• 9.3CVSS 4.0, Criticalfrom the CNA (ConnectWise)CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What to do

• Cloud: No action required. ConnectWise disabled and removed the affected third-party RMM+ extensions from cloud-hosted ScreenConnect environments. On-Premise: * Disable the RMM+ extension immediately and verify that it remains disabled. * Do not re-enable or reinstall it pending further guidance.CNA solution statement

Historical context and remediation

This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.

CAPEC-70 Try Common or Default Usernames and Passwords (CNA impact statement)

Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.

Read the original CVE record.

Affected products

Timeline

1. 12 Nov 2026 Published

Weakness

• CWE-1392

References

• github.com