627/69 Friday, November 13, 2026
ConnectWise has disclosed that it is investigating incidents in which attackers gained unauthorized access to ScreenConnect accounts belonging to Managed Service Providers (MSPs) and used the platform to install additional remote access software on customer devices. Huntress identified at least six compromised MSPs, with more than 286 affected devices across 47 organizations. ConnectWise has not found evidence that the incidents resulted from a compromise of its own infrastructure or from exploitation of a ScreenConnect vulnerability. The initial access vector used by the attackers remains under investigation.
After gaining access to ScreenConnect, the attackers used the platform’s Run Command functionality to install attacker-controlled ScreenConnect clients on customer devices, allowing them to maintain access independently of the MSP’s ScreenConnect environment. ConnectWise also identified five third-party extensions that may be related to the incidents: Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link, and RMM+ Password Link. As a precaution, the company disabled these extensions across approximately 400 partner environments. However, there is currently no confirmation that the extensions were the entry point used by the attackers.
ScreenConnect administrators should review and disable the five affected extensions, particularly in on-premises environments where the action must be performed manually, and should not reinstall or re-enable them until further guidance is available. Administrators should also review authentication logs, extension installation history, administrator account activity, Run Command and Toolbox activity, and look for unauthorized remote access software. If compromise is suspected, organizations should avoid connecting to affected systems through interactive ScreenConnect sessions.