CVE-2026-127063

Name of the Vulnerable Software and Affected Versions DataComm RMM+ extension for ConnectWise ScreenConnect (affected versions not specified)

Description The third-party RMM+ extension for ConnectWise ScreenConnect uses a static API secret by default. If an administrator does not change this value, unauthorized users may gain access to extension API functionality, enabling them to send commands to managed agents without authentication. Approximately 400 environments were identified as having the flagged extension installed. Real-world incidents involving unauthorized partner access and the deployment of rogue clients have been reported. This issue is isolated to the third-party extension and does not impact the core ScreenConnect server or client software.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Disable the RMM+ extension. Change the default API secret to a unique value.