ConnectWise Disables Five ScreenConnect Extensions After Partner Account Intrusions
Do Son 
| At a glance | |
| Actor | Unknown; not identified by ConnectWise |
| Activity | Unauthorized partner account access and deployment of extra remote-access software |
| Targets | ScreenConnect partners and their customers |
| Scale | About 400 partner environments ran one or more of the flagged extensions |
| Status | Cause and scope under investigation; no law-enforcement action reported |
TL;DR
On November 11, 2026, ConnectWise disabled five third-party ScreenConnect extensions in about 400 partner environments. The move follows reports of unauthorized access to ScreenConnect partner accounts. ConnectWise says the extensions “may be associated” with the activity, but their presence alone does not prove impact.
What happened
ConnectWise says attackers used ScreenConnect features after gaining access to partner accounts. They then deployed other remote-access software in customer environments.
The company suspects the attacker pushed that software through independent extensions that partners had added. Reports also describe possible compromise of technician workstations during live sessions. However, ConnectWise says these behaviors “remain subject to validation.”
The disabled ScreenConnect extensions
- Labtech Plus
- RMM Plus and RMM+
- RMM Plus Password Link and RMM+ Password Link
ConnectWise disabled these as a precaution where it could. However, it cannot act for on-premise partners, who must disable them themselves.
Who is behind it
ConnectWise has not named an attacker. It also has not found the initial access method. The extensions come from outside developers, and the advisory does not accuse those developers of wrongdoing.
Impact and scale
About 400 partner environments had at least one flagged extension. Partners who never installed them have “no reason to believe” they are affected, ConnectWise says. Still, it urges every partner to stay alert.
The risk reaches beyond the vendor. Each compromised partner may manage many customer networks. As a result, access to ScreenConnect partner accounts can open a path into every client those partners support.
How to stay protected
The ConnectWise security advisories page will carry updates. Meanwhile, partners using these ScreenConnect extensions should:
- Confirm the extensions are disabled, and do not reinstall them.
- Avoid opening live sessions to suspect devices. Use separate security tools instead.
- Revoke active sessions, reset passwords, and enforce MFA from a trusted device.
- Keep logs for logins, extension installs, Run Command, and Toolbox use.
- Isolate affected endpoints and technician workstations before cleanup.
As ConnectWise warns, disabling extensions and resetting credentials “may not remove access already established on endpoints.”
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
