Have you checked your ScreenConnect partner environment for this campaign?
ConnectWise updated its ScreenConnect advisory at 02:45 GMT on 12 November 2026, with status investigation ongoing. It is investigating unauthorised access to certain partner ScreenConnect environments, and says it has found no evidence of a compromise of ConnectWise infrastructure or a vulnerability in ScreenConnect itself. There is no CVE and no patch. ConnectWise has disabled five third-party extensions as a precaution and cannot take that action for on-premises partners. Follow ConnectWise's steps now; there is no patch to wait for.
Investigation ongoing. No evidence of a ScreenConnect vulnerability. No CVE or patch. Follow ConnectWise now.
ConnectWise's ScreenConnect advisory, first published at 22:45 GMT on 11 November 2026 and updated at 02:45 GMT on 12 November 2026, is in status investigation ongoing. We re-checked it at 07:00 GMT on 12 November 2026. ConnectWise is investigating unauthorised access to certain partner ScreenConnect environments, and says that at this time it has found no evidence of a compromise of ConnectWise infrastructure or a vulnerability in ScreenConnect itself. There is no CVE and no patch. ConnectWise has disabled five third-party extensions as a precaution wherever it can take action, and cannot perform that action for on-premises partners, who must disable the extensions themselves. A BleepingComputer report, published at 22:56 GMT on 11 November 2026 and updated at 02:06 GMT on 12 November 2026, citing security researchers, describes an active campaign against MSPs. We make no claim of our own about confirmed compromise in any estate.
By Simon Phillips, CTO. Reviewed by Oliver Legg, Head of SOC and IR. Last updated 12 November 2026, 07:05 GMT.
At a Glance
Based on the ConnectWise ScreenConnect advisory, latest update 02:45 GMT on 12 November 2026, re-checked at 07:00 GMT the same day, and a BleepingComputer report published at 22:56 GMT on 11 November 2026 and updated at 02:06 GMT on 12 November 2026. Last updated 12 November 2026, 07:05 GMT.
Critical (by impact)
There is no CVE and ConnectWise has not published a CVSS or other vendor score. Critical by impact is our framing, because unauthorised access to a ScreenConnect partner environment can reach customer environments.
Investigation ongoing
ConnectWise's latest update, at 02:45 GMT on 12 November 2026, is in status investigation ongoing. The original 11 November advisory, still on the Trust Center, was in status cause and scope under investigation. ConnectWise says it has found no evidence of a compromise of ConnectWise infrastructure or a vulnerability in ScreenConnect itself. Its initial assessment suggests the activity may involve abuse of independent third-party extensions installed in partner environments, and it is continuing to validate that assessment. The initial access method and full scope remain under investigation. We make no claim either way beyond what ConnectWise and the BleepingComputer report state.
Certain partner ScreenConnect environments
ConnectWise is investigating unauthorised access to certain partner ScreenConnect environments. It identified approximately 400 partner environments with at least one independently developed third-party extension from the RMM+ family installed. Their presence alone does not establish compromise. The original 11 November wording said the presence of these extensions does not, by itself, establish impact. ConnectWise says it does not have visibility or telemetry into activity within partner environments following initial access, and cannot independently determine what may have occurred; partners must assess their own environments.
No CVE or patch
This is not a vulnerability advisory with a fixed build. There is no patch to wait for. ConnectWise's path is to disable the named extensions, investigate with separate tooling, secure access, preserve evidence, isolate affected devices, and keep security controls current.
Security researchers, as cited in the BleepingComputer report, say the campaign started around 17:47 GMT on 11 November 2026.
ConnectWise publishes its ScreenConnect security advisory, with status cause and scope under investigation.
The BleepingComputer report is published. At the time of writing it gives 6 MSPs, 286 endpoints and 47 organisations.
The BleepingComputer report is updated. At the time of writing it still gives 6 MSPs, 286 endpoints and 47 organisations.
ConnectWise updates the advisory. Status is investigation ongoing. It says it has found no evidence of a compromise of ConnectWise infrastructure or a vulnerability in ScreenConnect itself, and it publishes indicators of compromise.
We re-checked the ConnectWise advisory and the BleepingComputer report. Recheck the Trust Center.
What ConnectWise describes
ConnectWise's latest update, at 02:45 GMT on 12 November 2026, says it is investigating reports of unauthorised access to certain partner ScreenConnect environments. At this time, it has found no evidence of a compromise of ConnectWise infrastructure or a vulnerability in ScreenConnect itself. Its initial assessment suggests the activity may involve a threat actor's abuse of independent third-party extensions installed in partner environments. It is continuing to validate this assessment. The initial access method and full scope remain under investigation.
ConnectWise identified approximately 400 partner environments with at least one independently developed third-party extension from the RMM+ family installed. Their presence alone does not establish compromise. It says these extensions provide an API capable of executing remote commands, and that access to that API is protected by a passphrase configured by the partner during setup. The five extensions identified for precautionary disabling are Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link, and RMM+ Password Link. ConnectWise disabled them wherever it can take action, advised on-premises partners to disable them (it cannot perform that action on their behalf), and is contacting all ScreenConnect partners. The original 11 November wording, still on the Trust Center, said these extensions may be associated with this activity, that ConnectWise was unable to take action for on-premises partners, and that the presence of the extensions does not, by itself, establish impact. Partners who have not deployed them had, in that wording, no reason to believe they were impacted, but should stay on heightened alert. The latest update still asks all partners, whether or not they use the extensions, to stay on heightened alert.
ConnectWise says it does not have visibility or telemetry into activity within partner environments following initial access, and cannot independently determine what actions may have occurred; partners must assess their own environments. The latest update asks partners with the extensions to include technician workstations that connected to those devices in the assessment. The 11 November wording said reports describing attackers using ScreenConnect functionality after unauthorised access, additional remote-access software through the extensions, and potential compromise of technician workstations during interactive connections, remained subject to validation.
What a BleepingComputer report describes
A BleepingComputer report, published at 22:56 GMT on 11 November 2026 and updated at 02:06 GMT on 12 November 2026, citing security researchers and not ConnectWise, says the campaign started around 17:47 GMT on 11 November 2026. At the time of writing it gives 6 compromised MSPs, 286 endpoints and 47 organisations. The researchers, as quoted in that report, say attackers used ScreenConnect's Run Command functionality to deploy ScreenConnect clients on managed endpoints, pointing at an instance that is not the legitimate MSP environment. The same report warns of potential compromise of a technician workstation when a session is opened to an infected customer device. ConnectWise has not confirmed those figures in its advisory.
Reported indicators of compromise
ConnectWise's 12 November 2026, 02:45 GMT update lists the following indicators to support investigation, and says they do not establish the initial access method or confirmed root cause. An absence of matches does not rule out compromise. We have not independently confirmed them in a customer environment. All are written in defanged form and are not links. IP addresses: 185.99.255[.]28 (ConnectWise: attacker-controlled ScreenConnect relay; hostname screen, as reported, unverified by us); 155.94.150[.]39 (ConnectWise: secondary command-and-control infrastructure; hostname WIN-FB5CKHMU4E1, as reported, unverified by us). Domains and URLs: ns.mo7sen[.]dev (ConnectWise: malicious PowerShell loader delivery); the staging URL listed as hxxps://ns.mo7sen[.]dev/EadF.php?p=4; sc.payproofkit[.]com (ConnectWise: rogue ScreenConnect deployment and secondary command-and-control); cdn007-digitaldownloads[.]com (ConnectWise: additional rogue ScreenConnect deployment; an earlier BleepingComputer report labelled this possible additional command-and-control only); newnewnew.gotdns[.]org and soxnewwork.homedns[.]org (ConnectWise: attacker command-and-control infrastructure). Files and scripts: sckit-run.bat, sckit-decoder.ps1, TrapWatch.ps1, Panel-Lateral.ps1 (ConnectWise says this filename was partially visible in the original evidence and requires confirmation), Run-Lateral-Full.bat, runnew.cmd, ToolboxRelayUploader.exe, and sqlite3.exe (ConnectWise: a legitimate utility reportedly abused to access browser-stored session and authentication data; its presence alone is not evidence of compromise). Filesystem and persistence: C:\ProgramData\RelayTrap\, C:\ProgramData\RelayTrap\TrapWatch.ps1, %TEMP%\sckit-*, a scheduled task named TrapWatch executing as SYSTEM (ConnectWise: reportedly every 10 seconds), and a registry Run-key value named RelayTrapLiteAlert. ScreenConnect-specific: rogue client IDs 2588ef5c15954b10 and ed630cc2c873b091; reported attacker-associated operator or account names Addmin and rmmserver. The BleepingComputer report also lists the installer pattern /Bin/ScreenConnect.ClientSetup.msi?...&c=Exploited<N> (detections match c=Exploited). That pattern is not in ConnectWise's 12 November list. New ConnectWise indicators that post-date Threat hunt's pack (sckit-run.bat, sckit-decoder.ps1, TrapWatch.ps1, sqlite3.exe, the RelayTrap paths, the TrapWatch scheduled task, RelayTrapLiteAlert, and rmmserver) are listed here as reported and are not in pack v1.
What to Do in the Next 24 Hours
Proactive on the left. Reactive on the right. Vendor steps and our advice are labelled separately.
Follow ConnectWise, then our advice
- ConnectWise: verify that the five named third-party extensions are disabled, preserve related records, and do not re-enable or reinstall them pending further guidance. ConnectWise cannot perform that action for on-premises partners, who must disable the extensions themselves.
- ConnectWise: investigate with separate security tooling, not interactive ScreenConnect sessions to suspected compromised devices, and include technician workstations that connected to those devices in the assessment.
- ConnectWise: from a trusted device, revoke ScreenConnect and identity-provider sessions, change relevant credentials, verify that multifactor authentication is enforced, use unique passwords, remove unnecessary administrative access, and review extension API access and configuration.
- Our advice: do ConnectWise's steps now; there is no patch to wait for. Restrict Run Command and Toolbox to roles that need them, run our checker with --expected-host, and rotate credentials. Hunt the newer ConnectWise indicators as well; they are not in pack v1.
Hunt and contain
- ConnectWise: keep authentication, extension-install, administrative, Run Command and Toolbox records, and look for unexpected accounts, permission changes, commands and remote-access installations.
- ConnectWise: isolate affected devices, preserve evidence before cleanup, and validate remediation before restoring connectivity. Disabling the extensions and changing credentials "alone may not remove unauthorized software, persistence mechanisms, or access already established on endpoints".
- Our advice: treat technician workstations as exposed, keep the audit database and session recordings, and hunt for ScreenConnect clients pointing at an instance that is not yours.
- Our advice: if you find signs of compromise, start incident response for every customer environment that partner account could reach. CybaOps can help you hunt and contain.
Proactive: Vendor Steps, Then Ours
ConnectWise's advice first, then our advice. Our advice is not a substitute for the official ConnectWise advisory or the ScreenConnect hardening guide. The steps below follow ConnectWise's 12 November 2026, 02:45 GMT update.
Verify the named extensions are disabled
ConnectWise's advice, from the 12 November 2026, 02:45 GMT ScreenConnect update: verify that Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link and RMM+ Password Link are disabled. On-premises partners should disable them immediately. Do not re-enable or reinstall them pending further guidance. ConnectWise disabled the extensions as a precaution wherever it can take action, and cannot perform that action for on-premises partners. See ConnectWise's extension guidance.
Investigate with separate tooling
ConnectWise's advice: investigate through separate security tooling. Avoid interactive ScreenConnect connections to suspected compromised devices. Include technician workstations that connected to those devices in the assessment. The 11 November wording said reports of workstation compromise during interactive connections remained subject to validation.
Secure access from a trusted device
ConnectWise's advice: from a trusted device, revoke active ScreenConnect and associated identity-provider sessions, change relevant credentials, verify that multifactor authentication is enforced, use unique passwords, and remove unnecessary administrative access. Review extension API access and configuration as part of the investigation. If a technician workstation may be compromised, use a separate, trusted device for these actions.
Preserve and review evidence
ConnectWise's advice: retain authentication, extension installation, administrative, Run Command and Toolbox records. Investigate unexpected accounts, permission changes, commands and remote-access installations.
Contain and remediate suspected compromise
ConnectWise's advice: follow established incident-response procedures, isolate affected devices, preserve evidence before removing artefacts, and validate remediation before restoring connectivity. Disabling the extensions and changing credentials "alone may not remove unauthorized software, persistence mechanisms, or access already established on endpoints".
Maintain security controls
ConnectWise's advice: keep servers, technician clients, endpoint agents, operating systems, browsers and endpoint protection current. Follow the ScreenConnect hardening guide. The 11 November wording also said updating software does not replace investigation and remediation of a suspected compromise.
Stay on heightened alert
ConnectWise's advice for all partners, whether or not they use the identified extensions: watch for unusual sign-ins, unfamiliar locations, repeated login failures and unexpected MFA prompts; investigate new administrator accounts or changes to user permissions; review unexpected extension installations, remote commands and Toolbox activity; check for unapproved remote-access software on customer devices and technician workstations; verify unexpected support requests, password-change messages and software downloads through a trusted channel; confirm endpoint protection is running and investigate alerts promptly; preserve suspicious activity logs and escalate concerns to your security team or provider.
Do the ConnectWise steps now; there is no patch to wait for
Our advice, not ConnectWise's wording: do ConnectWise's steps now, including the heightened-alert checks for every partner. There is no CVE and no patch to wait for.
Restrict Run Command and Toolbox, run the checker, and rotate credentials
Our advice: restrict Run Command and Toolbox to roles that need them. Run our checker with --expected-host (and --extensions-dir, --clients or --files-root as required). Rotate ScreenConnect credentials and related identity-provider credentials after you have secured access from a trusted device. Hunt the newer ConnectWise indicators as well; they are not in pack v1.
Treat technician workstations as exposed, and keep records
Our advice: treat technician workstations as exposed. Keep the audit database and session recordings. ConnectWise's latest update asks partners to include those workstations in the assessment. The 11 November wording said reports of a workstation pivot remained subject to validation.
Free Detection Pack
Built by the CybaVerse threat hunt team for businesses, internal IT teams and MSPs. Check exposure offline and hunt for signs of misuse. Everything is read-only.
check-screenconnect-extensions.sh
Read-only, offline checker. Point it at a copy of App_Extensions with --extensions-dir, at a clients export with --clients and --expected-host, and at a folder of files with --files-root. It never contacts ScreenConnect, writes nothing, runs nothing, and never prints keys (the k=, v= and s= client parameters are not printed).
bash check-screenconnect-extensions.sh --extensions-dir /path/to/App_Extensions --clients services.txt --expected-host your-relay.example --files-root /path/to/folderCheck-ScreenConnectExtensions.ps1
The same checks in PowerShell 7, with identical output and exit codes. On Windows, --local reads this machine's ScreenConnect client services and, if present, the default App_Extensions folder, still read-only. It also never prints keys. Use --expected-host with your own relay host.
pwsh -File Check-ScreenConnectExtensions.ps1 --local --expected-host your-relay.exampleKQL and Sigma
22 KQL hunts (Q1 to Q1e inventory; Q2 to Q2g indicators from the BleepingComputer report; Q3 to Q7 our patterns). 7 Sigma rules (4 IOC, 3 our patterns), with Kusto conversions included. None of the KQL has been run against a live tenant. Some Sigma rules convert on all listed Microsoft pipelines; two need your relay host filled in first. Where a rule does not convert, use the KQL hunts. This pack predates ConnectWise's 12 November 2026, 02:45 GMT indicator list; the newer ConnectWise indicators are on the page as reported and are not in these hunts.
Verdicts
- FINDINGSA named extension, rogue client ID, listed host, Exploited tag, or named file was found. Review it with separate tooling.
- REVIEWA near-matching extension name, a relay host that is not in --expected-host, or a loose file to review. Not a confirmed finding on its own.
- UNKNOWNPart of the input could not be read or classified, and nothing worse was found.
- NO FINDINGSNothing matched in the files that were supplied.
Exit codes
| Code | Meaning |
|---|---|
| 0 | NO FINDINGS |
| 1 | FINDINGS |
| 5 | REVIEW (no findings) |
| 3 | UNKNOWN (nothing worse) |
| 4 | Usage or read error |
The full pack zip contains 44 files: 22 KQL hunts, 7 Sigma rules, both checkers, tests and the README.
Know the limits
- Both checkers are read-only and offline. They only read the files or local registry path you point them at, send no network traffic, write nothing, run nothing, and never print keys.
- None of the KQL has been run against a live tenant. Tune it before relying on it.
- Where ScreenConnect stores extensions on disk, and the client service parameters (including h=, p=, k=, s= and c=), are as commonly observed on installations. ConnectWise's documentation covers the Extensions page in the web console, not the on-disk layout or those client service parameters.
- Q2 to Q2g and the four IOC Sigma rules use indicators from the BleepingComputer report, which this pack was built against. ConnectWise published a longer indicator list at 02:45 GMT on 12 November 2026. New ConnectWise indicators that post-date the pack, including sckit-run.bat, sckit-decoder.ps1, TrapWatch.ps1, sqlite3.exe, the RelayTrap paths, the TrapWatch scheduled task, the RelayTrapLiteAlert registry value, and the account name rmmserver, are listed on this page as reported. They are not in this pack.
- ConnectWise lists cdn007-digitaldownloads[.]com as additional rogue ScreenConnect deployment. An earlier BleepingComputer report labelled it possible additional command-and-control only.
What is in the pack
| File | What it does |
|---|---|
| check-screenconnect-extensions.sh | Read-only checker for Linux and macOS (bash) |
| Check-ScreenConnectExtensions.ps1 | The same checker in PowerShell 7, with --local on Windows |
| KQL (22 hunts) | Q1 to Q1e inventory; Q2 to Q2g from the BleepingComputer report; Q3 to Q7 our patterns |
| Sigma (7 rules) | 4 IOC, 3 our patterns; Kusto conversions included |
| tests/ | Fixtures and tests (in the full pack) |
| README.md | Verified facts, ConnectWise vs our advice, limits and usage |
Reactive: How to Hunt (Our Advice)
The hunts below are CybaVerse advice, our own patterns, informed by the ConnectWise advisory and by indicators in a BleepingComputer report. None of the KQL has been run against a live tenant. Pack v1 predates ConnectWise's 12 November 2026, 02:45 GMT indicator list; hunt those newer indicators as reported on this page. CybaOps can run a hunt across your estate or your clients'.
Run the checker with --expected-host
Our advice: inventory ScreenConnect servers, technician clients and endpoint agents. Run our read-only checker with --expected-host, and with --extensions-dir, --clients or --files-root as required, to find ScreenConnect clients pointing at an instance that is not yours and to list the five named extensions on an on-premises server copy. The checker never prints keys. These are our patterns for finding exposure, not official ConnectWise indicators.
Review the reported indicators
Our advice: search logs, DNS, proxy and endpoint telemetry for the defanged indicators listed by ConnectWise in its 12 November update, and for the installer pattern in the BleepingComputer report, and review Run Command and Toolbox history for unexpected deployments or commands. The report also says ScreenConnect users should check Run Command history even if they have not received alerts. Treat hits as leads to investigate, not as proof on their own. The pack includes 22 KQL hunts and 7 Sigma rules, built against the earlier BleepingComputer list; none of the KQL has been run against a live tenant. New ConnectWise indicators that post-date the pack are listed on this page as reported and are not in pack v1.
Technician workstations, audit records and recordings
Our advice: treat technician workstations as exposed, and review them with separate tooling. Do not open interactive ScreenConnect sessions to suspected compromised devices. Keep the audit database and session recordings. ConnectWise's latest update asks partners to include those workstations in the assessment. The 11 November wording said reports of technician workstations being compromised during interactive sessions to affected devices remained subject to validation.
If you find signs of compromise (our advice)
- Isolate affected customer devices and any technician workstations that may be involved, and preserve evidence before cleanup. Disabling the extensions and changing credentials "alone may not remove unauthorized software, persistence mechanisms, or access already established on endpoints".
- Rotate ScreenConnect credentials and related identity-provider credentials, and from a trusted device revoke sessions and verify that multifactor authentication is enforced.
- Hunt for ScreenConnect clients pointing at an instance that is not yours, run the checker with --expected-host, and review the ConnectWise indicators and the installer pattern in the BleepingComputer report. Remember that pack v1 predates the newer ConnectWise indicators.
- Keep the audit database and session recordings.
- Start incident response for every customer environment that the partner account could reach, not only the ScreenConnect host.
- CybaOps can help you hunt and contain across your estate and your clients' environments.
ScreenConnect Partner-Account Campaign FAQ
Short answers based on the ConnectWise ScreenConnect advisory and a BleepingComputer report. The advisory was re-checked at 07:00 GMT on 12 November 2026.
What is this campaign?
ConnectWise's ScreenConnect advisory, first published at 22:45 GMT on 11 November 2026 and updated at 02:45 GMT on 12 November 2026, says it is investigating unauthorised access to certain partner ScreenConnect environments. The latest status, when we re-checked at 07:00 GMT on 12 November 2026, was investigation ongoing. ConnectWise says it has found no evidence of a compromise of ConnectWise infrastructure or a vulnerability in ScreenConnect itself. There is no CVE and no patch. A BleepingComputer report, published at 22:56 GMT on 11 November 2026 and updated at 02:06 GMT on 12 November 2026, citing security researchers, describes an active campaign against MSPs.
How severe is it, and is there a fix?
There is no CVE and ConnectWise has not published a CVSS or other vendor score. Critical by impact is our framing, because a compromised ScreenConnect partner environment can reach customer environments. ConnectWise's path is precautionary containment and investigation, not a software patch. There is no patch to wait for. Recheck the advisory.
Which extensions did ConnectWise name?
ConnectWise names five independent third-party extensions from the RMM+ family for precautionary disabling: Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link, and RMM+ Password Link. It identified approximately 400 partner environments with at least one of them installed, and disabled the extensions as a precaution wherever it can take action. It cannot perform that action for on-premises partners, who must disable them themselves. Their presence alone does not establish compromise. The original 11 November wording said these extensions may be associated with this activity, and that their presence does not, by itself, establish impact. ConnectWise also says these extensions provide an API capable of executing remote commands, protected by a passphrase configured by the partner during setup.
If we have those extensions, or if we do not, are we affected?
ConnectWise says the presence of these third-party extensions alone does not establish compromise, and the original 11 November wording said their presence does not, by itself, establish impact. If you have not deployed them, that earlier wording said ConnectWise had no reason to believe you were impacted, but encouraged all partners to stay on heightened alert. The latest update still asks all partners, whether or not they use the extensions, to stay on heightened alert. Initial access and full scope remain under investigation.
What does the BleepingComputer report say, and is this confirmed exploitation?
A BleepingComputer report, published at 22:56 GMT on 11 November 2026 and updated at 02:06 GMT on 12 November 2026, citing security researchers and not ConnectWise, says the campaign started around 17:47 GMT on 11 November 2026. At the time of writing it gives 6 compromised MSPs, 286 endpoints and 47 organisations. ConnectWise has not confirmed those figures in its advisory, and says the initial access method and full scope remain under investigation. It also says it has found no evidence of a compromise of ConnectWise infrastructure or a vulnerability in ScreenConnect itself. The 11 November wording said reports of technician workstation compromise during interactive sessions remained subject to validation. We make no claim of our own either way.
What should we do first?
Do ConnectWise's steps now; there is no patch to wait for. Verify the named extensions are disabled, preserve their records, and do not re-enable or reinstall them; investigate with separate tooling, not interactive ScreenConnect sessions, and include technician workstations that connected to those devices in the assessment; from a trusted device revoke sessions, change credentials, verify that multifactor authentication is enforced, use unique passwords, remove unnecessary administrative access, and review extension API access; keep authentication, extension-install, admin, Run Command and Toolbox records; isolate affected devices and preserve evidence (disabling the extensions and changing credentials "alone may not remove unauthorized software, persistence mechanisms, or access already established on endpoints"); keep servers, technician clients, agents, operating systems, browsers and endpoint protection current, and follow the hardening guide. All partners should stay on heightened alert. Our advice: restrict Run Command and Toolbox to roles that need them, run our checker with --expected-host, treat technician workstations as exposed, keep the audit database and session recordings, rotate credentials, and hunt the newer ConnectWise indicators that are not in pack v1.
Who is this relevant to?
MSPs and IT teams that use ConnectWise ScreenConnect to support customer environments, especially those who have installed one of the five named third-party extensions. Partners without those extensions should still stay on heightened alert, as ConnectWise advises.
Protect Your Partner Access, and Your Clients'
CybaOps monitors your servers, endpoints and cloud workloads, whether that's your own business or your clients'. UK-based analysts monitor alerts 24/7, run these threat hunts and act on pre-approved response actions, and CybaOps drives remediation through to a verified fix, so proactive checks and reactive response happen in one place.
Sources
- ConnectWise: ScreenConnect security advisory, precautionary extension disabling and partner guidance (first published 11 November 2026, 22:45 GMT; latest update 12 November 2026, 02:45 GMT, status: investigation ongoing; re-checked 12 November 2026, 07:00 GMT)
- ConnectWise: ScreenConnect hardening guide (linked from the advisory)
- ConnectWise: instructions for uninstalling or disabling a ScreenConnect extension (linked from the advisory)
- BleepingComputer: Active ScreenConnect attacks breach MSPs, impact dozens of organizations (published 11 November 2026, 22:56 GMT; updated 12 November 2026, 02:06 GMT; checked 12 November 2026, 07:00 GMT)