# ScreenConnect: disable RMM+ extensions during access investigation Canonical: https://www.oktsec.com/radar/screenconnect-rmm-plus-extension-investigation-november-2026 Publisher: Oktsec Language: en Published: 2026-11-12T12:27:20Z Updated: 2026-11-12T12:27:20Z Record reviewed: 2026-11-12T12:27:20Z Latest evidence check: 2026-11-12T12:27:20Z Disclosed: 2026-11-11 ConnectWise is investigating unauthorized access reports involving partner environments and possible abuse of RMM+ extensions. About 400 environments had an extension installed; that count does not establish compromise. ## Evidence and response priority - Category: Platform incident - Oktsec priority: Act now - Rationale: ConnectWise calls for immediate disabling of the listed extensions and investigation of partner environments. The initial access method and full scope remain under investigation. - Evidence: Incident confirmed by provider - Verification: Vendor confirmed - Fix status: Not applicable - Exposure requirement: Application or configuration dependent - Vendor: ConnectWise - Products: ScreenConnect partner environments, RMM+ extensions ## Technical overview ConnectWise’s November 12 update says the initial access method and full scope are still under investigation. It has not found evidence of compromised ConnectWise infrastructure or a vulnerability in ScreenConnect itself. Its working assessment concerns possible abuse of independently developed extensions, not a confirmed root cause. The five named extensions expose a remote command API protected by a partner configured passphrase. ConnectWise identified approximately 400 environments with at least one installed and disabled the extensions wherever it could act. This is an installation count, not a victim count. Check that the extensions remain disabled. Operators of installations on their own premises must act themselves. Investigate through separate security tools and avoid interactive ScreenConnect connections to suspected devices; assess technician workstations that connected to them. The vendor lacks telemetry into partner activity after initial access. Each organization must assess its own evidence, secure access from a trusted device, and validate remediation before restoring connectivity. ## Recommended response Disable the listed RMM+ extensions and keep them disabled. Investigate with separate security tools; avoid interactive ScreenConnect sessions to suspected devices. Relevant to: ScreenConnect administrators, MSP security teams and customer teams whose devices may have been reached through the affected partner environments. ## Affected systems and fixes ### ScreenConnect environments with RMM+ family extensions Affected: Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link or RMM+ Password Link installed; installation alone does not prove compromise. Fixed release / action: Disable the extensions and do not reinstall or enable them pending vendor guidance. This is a precaution, not a ScreenConnect version fix. Confirm the running version against the vendor advisory, including any distribution backports. ## Response checklist 1. **Verify extensions are disabled** — Check all instances for the five named extensions. ConnectWise disabled them where it could; operators of installations on their own premises must disable them themselves. Do not re-enable them. 2. **Investigate without interactive ScreenConnect access** — Use separate security tooling for suspected devices. Include technician workstations that connected to them in the assessment. 3. **Preserve commands and access records** — Retain authentication, extension installation, administrative, Run Command and Toolbox records. Review unexpected accounts, permissions, commands and remote access software. 4. **Secure access from a trusted device** — Follow the vendor guidance to revoke ScreenConnect and identity provider sessions, reset relevant credentials, enforce MFA and review extension API access. Coordinate containment and preserve evidence before removing artifacts. ## Relevance to AI environments Include unattended remote administration and automation accounts when reviewing commands and access; the advisory does not establish AI involvement. ## Sources - [ConnectWise: November 12, 02:45 UTC investigation update](https://www.connectwise.com/company/trust/advisories) — ConnectWise; Vendor notice; checked 2026-11-12T12:27:20Z ## Editorial record - 2026-11-12T12:27:20Z: Added verified vendor scope, response actions and the limits of the available evidence. ## Use this advisory in Radar Use the Advisory view to understand the issue and its evidence, Affected systems to compare versions, and Response plan to record applicability, an owner and action progress. Plans are saved only in the current browser and can be downloaded for sharing; they are not a shared team account or an automated scan. Completing a plan does not validate remediation. Talk to Oktsec opens a technical consultation with the advisory and selected service preserved. Scope, fees and access are agreed before any assessment. [Open advisory](https://www.oktsec.com/radar/screenconnect-rmm-plus-extension-investigation-november-2026) · [Build a response plan](https://www.oktsec.com/radar/screenconnect-rmm-plus-extension-investigation-november-2026#review-workspace) - [Exposure check consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=screenconnect-rmm-plus-extension-investigation-november-2026&service=exposure_check) ## Scope and corrections Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure. [Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.