Live threats
HighUnpatched Check Point Gateways Exploited via PHP2Shell, Granting Root Access and Enabling Wiper Attacks BreachUS DOJ Seizes $1.2 B Stolen from Binance Theft and Disrupts North Korean ‘FaceStealer’ Social‑Engineering Tool Rule changeFederal Register limits automated scraping of its sites, directing users to APIs DeadlineFrench court orders DNS resolver Quad9 to block sites, prompting its withdrawal from France CriticalCritical Authentication Bypass and DoS Flaws in Citrix NetScaler ADC & Gateway (CVE‑2026‑120868) BreachThird‑Party Extension Abuse Leads to Unauthorized Access in ~50 ConnectWise ScreenConnect Environments Rule changeAmended California Consumer Privacy Act (Prop. 24) set to become effective Jan 1 2026 CriticalZoom Patches Critical Windows Privilege‑Escalation Flaws (CVE‑2026‑108186 & CVE‑2026‑108187)
Updated 08:43 UTC All intelligence →
Digital Trust PractitionersAssociation of Digital Trust Practitioners · TrustPractitioners.org
EN
JoinJoin
BREACH WATCH BRIEF High 🔑 Breach

Third‑Party Extension Abuse Leads to Unauthorized Access in ~50 ConnectWise ScreenConnect Environments

ConnectWise discovered that a third‑party extension (RMM+) was abused to obtain unauthorized remote access in roughly 50 organizations. The breach stemmed from compromised credentials and session hijacking, highlighting the need for continuous vendor oversight and credential hygiene for remote‑access tools.

ADTP Breach Watch · November 12, 2026 · The Record
SeverityHigh
Type🔑 Breach
ConfidenceHigh
ReportedNov 12, 2026
Technology & SaaS Managed Service Providers (MSPs) and their client enterprises Stolen Credentials Credential Compromise
Check if you use it. This incident came through a third party or the supply chain. If the product or supplier is in your estate or your vendors', start with the questions to ask below.

What happened

Nearly 50 organizations experienced unauthorized remote access through ConnectWise ScreenConnect after attackers abused the RMM+ third‑party extension, likely using stolen credentials or hijacked operator sessions.

Why it matters for trust and compliance

  • The incident demonstrates why continuous monitoring of third‑party extensions and strict credential controls are essential for audit‑ready remote‑access environments.
  • Continuous monitoring of third‑party extensions provides evidence for supply‑chain risk controls.
  • Credential rotation and MFA strengthen access‑control objectives across frameworks.

Who is affected

Managed Service Providers (MSPs) and their client enterprises

Recommended actions

  1. Disable all third‑party extensions (including RMM+) in ScreenConnect deployments.
  2. Rotate and harden all operator credentials; enforce multi‑factor authentication.
  3. Apply the latest ScreenConnect patch that resolves CVE‑2026‑84869.
  4. Implement continuous monitoring of API usage and remote‑session logs.
  5. Audit privileged access and enforce least‑privilege principles for technicians.

Regulations library

Every US state privacy law, on one map

24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.

Explore the mapFollow Regulatory Watch
  • In force
  • Coming into force
  • Sector laws
AK ME VT NH WA ID MT ND MN IL WI MI NY RI MA OR NV WY SD IA IN OH PA NJ CT CA UT CO NE MO KY WV VA MD DE AZ NM KS AR TN NC SC DC OK LA MS AL GA HI TX FL

Get the Breach Digest

The incidents that matter for your vendors and your data, analyzed for practitioners, in one email.