Third‑Party Extension Abuse Leads to Unauthorized Access in ~50 ConnectWise ScreenConnect Environments

ما الذي حدث

Nearly 50 organizations experienced unauthorized remote access through ConnectWise ScreenConnect after attackers abused the RMM+ third‑party extension, likely using stolen credentials or hijacked operator sessions.

لماذا يهم ذلك للثقة والامتثال

• The incident demonstrates why continuous monitoring of third‑party extensions and strict credential controls are essential for audit‑ready remote‑access environments.
• Continuous monitoring of third‑party extensions provides evidence for supply‑chain risk controls.
• Credential rotation and MFA strengthen access‑control objectives across frameworks.

Who is affected

Recommended actions

1. Disable all third‑party extensions (including RMM+) in ScreenConnect deployments.
2. Rotate and harden all operator credentials; enforce multi‑factor authentication.
3. Apply the latest ScreenConnect patch that resolves CVE‑2026‑84869.
4. Implement continuous monitoring of API usage and remote‑session logs.
5. Audit privileged access and enforce least‑privilege principles for technicians.