ConnectWise disables ScreenConnect extensions after intrusions

On 11 November 2026, ConnectWise disabled five third‑party ScreenConnect extensions in around 400 partner environments after reports of unauthorized access to ScreenConnect partner accounts. ConnectWise says the extensions may be linked to the activity, but the presence of the extensions alone does not prove that impact occurred.

The attacker is not identified, and initial access methods have not been disclosed; the extensions involved were created by outside developers, and the advisory does not accuse those developers of wrongdoing.

The disabled extensions are Labtech Plus, RMM Plus, RMM+ and RMM Plus Password Link, and RMM+ Password Link. ConnectWise acted to deactivate these where possible, noting that on‑premise partners must disable them themselves. The incident potentially allowed the attacker to use ScreenConnect features to deploy other remote‑access software in customer environments, and there is mention of possible compromise of technician workstations during live sessions, though this remains subject to validation.

About 400 partner environments had at least one flagged extension; partners that never installed the extensions say they have no reason to believe they are affected, but ConnectWise urges vigilance. Partners should follow ConnectWise advisories for updates, confirm extensions are disabled and not reinstalled, revoke active sessions, reset passwords and enforce MFA from a trusted device, keep login and extension‑installation logs, and isolate affected endpoints and technician workstations before cleanup. ConnectWise cautions that disabling extensions and resetting credentials may not remove access already established on endpoints.