ScreenConnect Users: Disable Flagged Extensions and Update Technician Clients

If your business gets IT support from a managed service provider (MSP) that uses ConnectWise ScreenConnect for remote support, this one is worth a quick conversation with them. ConnectWise and Microsoft report an active campaign, starting November 11, 2026, in which attackers got into some MSPs' ScreenConnect servers and used them to push extra, unauthorized remote-access software to the computers those MSPs manage.

The short version: if you or your IT provider run ScreenConnect, disable the third-party extensions ConnectWise has flagged, make sure every technician's ScreenConnect client is on version 26.6.5 or later, and check managed computers for remote-access software nobody approved.

What happened

ScreenConnect is a widely used remote-support tool. MSPs use it to connect to customer computers to fix problems. According to ConnectWise, the attackers appear to have gotten in through independently developed third-party extensions installed on some partners' ScreenConnect servers, not through a flaw in ScreenConnect itself, and ConnectWise says it has found no evidence that its own infrastructure was compromised. Researchers reported that one of these extensions, RMM+ versions 1.0.31 and 1.0.32, could accept a blank access key if one had never been set.

Once inside, the attackers used ScreenConnect's own command feature to quietly install a second ScreenConnect client that connects to their servers, along with a toolkit Microsoft calls SCKit. Microsoft says the toolkit sets itself up to survive restarts and includes a piece designed to jump to a technician's computer when the technician connects for support. ConnectWise says ScreenConnect client version 26.6.5 and later, released September 8, 2026 with the fix for CVE-2026-84869, blocks that spread technique, and researchers say they have not seen it succeed so far.

Security firm Huntress reported at least 288 affected computers across 48 organizations in the first wave. ConnectWise said about 400 partner environments had at least one of the flagged extensions installed, and noted that having one installed does not by itself mean a system was compromised. On November 13, ConnectWise said researchers were also seeing activity against on-premises ScreenConnect servers where the extensions were still turned on.

Who is at risk

• MSPs and IT teams running ScreenConnect, cloud-hosted or on-premises, especially with any of these extensions installed: Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link, or RMM+ Password Link. ConnectWise has also disabled ITBoost Integration, RepairShopr Integration, and Guest Session Starter in cloud environments as a precaution.
• Businesses whose computers are managed through those ScreenConnect servers. The attackers' goal was remote access to the managed computers.
• Technician workstations still running a ScreenConnect client older than 26.6.5.

What to do this week

1. Disable the flagged extensions. ConnectWise has turned them off in its cloud, but it cannot do that for on-premises servers. On-premises owners need to disable them now and leave them off until ConnectWise says otherwise.
2. Update every technician client to 26.6.5 or later. ConnectWise notes that updating the server or cloud console does not update the clients on technicians' computers. Check each one.
3. Look for remote-access software you did not approve. An extra ScreenConnect client, or one pointing to an unfamiliar server, is a red flag. Review ScreenConnect's command history and recent administrative changes too.
4. Sign everyone out and tighten logins. From a computer you trust, end active ScreenConnect sessions, reset the relevant passwords, and make sure multifactor authentication is on. ConnectWise and Microsoft both note that a password change alone does not end existing sessions.
5. Do not use ScreenConnect to clean up a computer you suspect is affected. Both companies advise investigating through a separate, trusted tool, such as your endpoint security software, so the problem cannot spread to the technician's machine.

Questions to ask your IT provider

1. Do you use ScreenConnect to support our computers? Cloud-hosted or your own server?
2. Were any of the extensions ConnectWise flagged installed, and are they disabled now?
3. Are all of your technicians' ScreenConnect clients on version 26.6.5 or later?
4. Have you checked our computers for unapproved remote-access software since November 11?