ConnectWise has issued an urgent security advisory following reports of unauthorized access to ScreenConnect environments used by managed service providers (MSPs). The attacks, discovered on November 11, 2026, involved threat actors deploying unauthorized remote-access software onto customer devices. Cybersecurity firm Huntress initially identified six compromised MSPs and more than 286 affected endpoints across 47 organizations, with subsequent reports identifying at least 288 devices across 48 organizations. ConnectWise confirmed that approximately 400 partner environments contained potentially associated third-party extensions, prompting precautionary security measures. However, the company emphasized that the presence of these extensions does not automatically indicate a compromise.
ConnectWise identified five third-party extensions potentially associated with the malicious activity: Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link, and RMM+ Password Link. The company disabled these extensions in cloud-hosted environments where it could take action and instructed on-premises administrators to disable them manually. Security researchers discovered attackers abusing remote command functionality to install rogue ScreenConnect clients, potentially allowing persistent unauthorized access to managed devices. Huntress also identified a malicious toolkit called SCKit associated with the campaign. In its November 12 advisory update, ConnectWise stated that investigators had found no evidence of compromised company infrastructure or that initial access involved a vulnerability in ScreenConnect itself. The initial intrusion method remains under investigation.
Organizations using ConnectWise ScreenConnect should immediately review installed extensions, authentication logs, administrative activity, remote command history, and endpoints for unauthorized remote-access software. Administrators should investigate suspicious sessions, rotate potentially compromised credentials, and avoid initiating interactive connections to suspected infected devices until they have been assessed through independent security tools. Disabling affected extensions alone does not remove malware or attacker persistence already established on endpoints. Security teams should also ensure ScreenConnect installations are updated to version 26.6.5 or later to address the separately disclosed CVE-2026-84869 vulnerability. The incident highlights the growing cybersecurity risks associated with third-party remote management extensions and the potential for attackers to compromise multiple organizations through trusted IT service providers.