ConnectWise Releases Security Advisory Following Unauthorised Access to ScreenConnect Environments
ConnectWise releases security advisory following abuse of third-party extensions to gain unauthorised access to ScreenConnect.
Summary
ConnectWise releases security advisory following abuse of third-party extensions to gain unauthorised access to ScreenConnect.
Threat details
Threat Actors Deploy Rogue ScreenConnect Clients and SCKit
Security researchers have observed deployment of threat actor controlled ScreenConnect clients and a toolkit named SCKit, affecting a large number of hosts across multiple ConnectWise partner organisations. The initial access vector and full scope of the activity have not been confirmed by ConnectWise.
The NHS England National CSOC assess that future exploitation is a realistic possibility.
Introduction
ConnectWise has published a security advisory to address reports of unauthorised access to certain partner ScreenConnect environments. Threat actors have leveraged five independent third party extensions to access multiple cloud-hosted ScreenConnect panels to execute commands to managed endpoints.
The following ScreenConnect extensions have been disabled by ConnectWise as a precaution:
- Labtech Plus
- RMM Plus
- RMM+
- RMM Plus Password Link
- RMM+ Password Link
The extensions provide remote command execution functionality through an API protected by a partner configured passphrase. The presence of these third party extensions does not, in isolation, indicate that an environment has been compromised.
Remediation advice
NHS organisations are encouraged to contact their ScreenConnect distributors to review their environments for the presence of the vulnerable extensions, suspicious Run Commands, toolbox records and unauthorised ScreenConnect clients.
Affected organisations are encouraged to review ConnetWise's security advisory and the ScreenConnect hardening guide for further guidance and recommended mitigations.
Definitive source of threat updates
Last edited: 12 November 2026 3:10 pm