ConnectWise releases security advisory following abuse of third-party extensions to gain unauthorised access to ScreenConnect.
ConnectWise releases security advisory following abuse of third-party extensions to gain unauthorised access to ScreenConnect.
The following platforms are known to be affected:
Threat Actors Deploy Rogue ScreenConnect Clients and SCKit
Security researchers have observed deployment of threat actor controlled ScreenConnect clients and a toolkit named SCKit, affecting a large number of hosts across multiple ConnectWise partner organisations. The initial access vector and full scope of the activity have not been confirmed by ConnectWise.
The NHS England National CSOC assess that future exploitation is a realistic possibility.
ConnectWise has published a security advisory to address reports of unauthorised access to certain partner ScreenConnect environments. Threat actors have leveraged five independent third party extensions to access multiple cloud-hosted ScreenConnect panels to execute commands to managed endpoints.
The following ScreenConnect extensions have been disabled by ConnectWise as a precaution:
RMM Plus Password Link
The extensions provide remote command execution functionality through an API protected by a partner configured passphrase. The presence of these third party extensions does not, in isolation, indicate that an environment has been compromised.
NHS organisations are encouraged to their ScreenConnect distributors to review their environments for the presence of the vulnerable extensions, suspicious Run Commands, toolbox records and unauthorised ScreenConnect clients.
Affected organisations are e ncouraged to review ConnetWise's security advisory and the ScreenConnect hardening guide for further guidance and recommended mitigations.
Definitive source of threat updates
Last edited: 12 November 2026 3:10 pm
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
