ConnectWise disables ScreenConnect extension after breaches at nearly 50 organizations

ConnectWise said late Wednesday it is investigating unauthorized access to customers after reports that nearly 50 organizations were breached through its ScreenConnect remote-support tool. The company said the activity appears tied to abuse of RMM+, an independently developed third-party extension that lets external management tools automate and control remote sessions through an API. ConnectWise disabled RMM+ in about 400 partner environments and told customers running on-premises systems to disable it themselves, because the vendor cannot do so remotely. It also urged customers to reset credentials and watch for unusual sign-ins and repeated login failures.

Huntress incident responders said they observed 288 affected endpoints across 48 organizations targeted within 90 minutes, with commands tied to RMM+ across several ScreenConnect systems. The firm said it has not seen evidence of a new vulnerability, but initial access remains unclear; telemetry points to compromised credentials or hijacked operator sessions. Blackpoint Cyber researchers Sam Decker and Nevan Beal said they reverse-engineered the attacker toolkit and linked it to CVE-2026-84869, a ConnectWise vulnerability the Cybersecurity and Infrastructure Security Agency warned was being exploited in September. They tested it against a fully patched client and said the patch blocks the exploit.

The pattern is familiar: attackers are not only breaking into software, but riding trusted administrative pathways. ScreenConnect is widely used by managed service providers, so a compromise can move from one technician session into many downstream customer environments. RMM+'s API can execute remote commands when protected only by a partner-configured passphrase, making credential theft or session hijacking especially dangerous. ConnectWise initially pointed to five extensions before narrowing the activity to RMM+, underscoring how third-party add-ons can expand a vendor's attack surface even when the core product is patched.

The incident affects organizations that depend on managed service providers for IT operations, because a single trusted support tool can become a bridge into networks that do not directly use it. ConnectWise warned that disabling extensions and resetting credentials may not remove unauthorized software, persistence mechanisms, or access already established on endpoints, and it flagged potential compromise of technician workstations during interactive connections. That means cleanup can require endpoint forensics and removal of backdoors, not just updating ScreenConnect.