managed service provider

Possible Abuse of Third-Party ScreenConnect Extensions (November 2026): ConnectWise Disables Them in About 400 Cloud Environments; a Security Firm Confirms Rogue Client Installs on at Least 288 Endpoints in 48 Organizations of Its Own Customers. What Users Should Do

ConnectWise published a security advisory on November 11, 2026 (22:45 UTC) about unauthorized access to some partner ScreenConnect environments, and updated it on November 12 (02:45 UTC and 18:45 UTC) and November 13 (21:15 UTC). According to the company, it has found no evidence that its own infrastructure was compromised or that initial access involved a vulnerability in ScreenConnect itself. Its initial assessment is that a threat actor may have abused independently developed third-party extensions installed in partner environments (still being validated). It identified about 400 partner environments with at least one extension from the RMM+ family and disabled them as a precaution in the cloud environments; the figure counts environments with the extensions installed, not confirmed compromises. On-premises partners must disable them themselves. It asks partners to update every technician client to 26.6.5 or later, review the Transfer Files permission, keep the extensions disabled, revoke sessions and reset credentials with MFA from a trusted device, and investigate with separate security tooling while preserving logs. It says it has no visibility into activity inside partner environments after initial access. Its November 13 update adds three more extensions disabled in cloud and marketplace environments and says on-premises partners must disable the extensions immediately. A security firm that investigated the activity reports, in its official blog, rogue client installs on at least 288 endpoints in 48 organizations on November 11 and, in a second wave on November 13, 205 endpoints in 41 organizations (counts within that firm's own customer base, not a total of victims). Our view: organizations that use ScreenConnect, and customers of managed service providers, should confirm the extension status and client versions now.