ScreenConnect disables five extensions after attacks on partner environments
ConnectWise is investigating unauthorized partner-account access and rogue remote-access software in customer environments. It disabled five third-party extensions in about 400 partner environments as a precaution. Initial access and the full scope remain under investigation.
- Disclosed
- Nov 11, 2026
- Public disclosure date
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- ScreenConnect partners with the five named extensions, including on-premises installs. Investigate potentially affected technician devices.
- ScreenConnect · RMM · supply chain
- In the wild
- Yes
- ConnectWise reports unauthorized partner access and rogue remote-access deployments.
What happened
ConnectWise says the extensions may be associated with the campaign. The roughly 400 environments had one or more of them installed. The vendor has not established the number of compromised environments, the initial access method or a CVE. It is investigating whether attackers used extensions to deploy additional remote access and whether interactive connections exposed technician workstations. Treat extension disabling as containment and check separately for persistence. This is distinct from the Cloud Backup incident.
Crime-scene timeline
Nov 11, 22:45 UTC
ConnectWise publishes precautionary guidance
The vendor lists five extensions and steps for hosted and on-premises partners.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- ConnectWise November 11 ScreenConnect advisoryPrimaryLists the five disabled extensions, approximately 400 environments with one or more installed, suspected behavior and partner actions.