CVE-2026-127063

The
third-party RMM+ extension for ConnectWise ScreenConnect uses a static API
secret by default. The value can be changed by an administrator; however,
environments retaining the default value may allow unauthorized access to
extension API functionality, including the ability to send commands to managed
agents. This issue is specific to the third-party extension and does not affect
the ScreenConnect server or client.





Scope: This issue affects the third-party RMM+
extension for ConnectWise ScreenConnect. Deployments without the extension are
not affected. ScreenConnect server or client software are not impacted.