CVE-2026-127063 PUBLISHED

Assigner: ConnectWise
Reserved: 12.11.2026 Published: 12.11.2026 Updated: 13.11.2026

The third-party RMM+ extension for ConnectWise ScreenConnect uses a static API secret by default. The value can be changed by an administrator; however, environments retaining the default value may allow unauthorized access to extension API functionality, including the ability to send commands to managed agents. This issue is specific to the third-party extension and does not affect the ScreenConnect server or client.

Scope: This issue affects the third-party RMM+ extension for ConnectWise ScreenConnect. Deployments without the extension are not affected. ScreenConnect server or client software are not impacted.

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS Score: 9.3

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	High	Confidentiality	None
Attack Complexity	Low	Integrity	High	Integrity	None
Attack Requirements	None	Availability	High	Availability	None
Privileges Required	None
User Interaction	None

CVSS 4.0

Product Status

Vendor	DataComm
Product	RMM+
Versions	Default: unaffected Version All extension versions is affected

Solutions

Cloud: No action required. ConnectWise disabled and removed the affected third-party RMM+ extensions from cloud-hosted ScreenConnect environments.

On-Premise:

Disable the RMM+ extension immediately and verify that it remains disabled.
Do not re-enable or reinstall it pending further guidance.

References

https://github.com/ConnectWise-Advisories/Disclosures/tree/main/CVE-2026-127063

Problem Types

CWE-1392 Use of default credentials CWE

Impacts

CAPEC-70 Try Common or Default Usernames and Passwords