Static API Secret Vulnerability in ConnectWise ScreenConnect's Third-Party RMM+ Extension

CVE-2026-127063

What is CVE-2026-127063?

The RMM+ extension for ConnectWise ScreenConnect contains a security issue arising from the use of a static API secret by default. While administrators have the option to modify this value, any environment that retains the default configuration is at risk of unauthorized access to the extension's API. This vulnerability can enable malicious actors to exploit the extension, potentially granting them the ability to send unauthorized commands to managed agents. It is important to note that this issue is exclusively linked to the third-party extension and does not extend to the core ScreenConnect server or client functionalities.

References