External risk intelligence

RMM+ Extension for ConnectWise ScreenConnect Default API Secret Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-127063

The vulnerability affects an extension for ConnectWise ScreenConnect, which is a remote monitoring and management (RMM) platform. RMM servers are typically deployed as internet-facing gateways or management portals to facilitate remote access, making the extension's API, which is accessible via the server, commonly exposed to the internet in real-world deployments.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability exists in a third-party extension for ConnectWise ScreenConnect that could allow unauthorized access to extension functionality, potentially enabling command execution on managed agents. This issue is specific to the extension and does not impact the core ScreenConnect software.

Extension uses a default secret for API access.
Risk of unauthorized control over managed devices.
Confirm if the affected extension is in use.

Attack Path

How an attacker could exploit the issue

An attacker could gain unauthorized access to the RMM+ extension's functionality by exploiting a default static API secret. This exposure allows them to send commands to managed agents, potentially leading to further compromise of systems. The issue is specific to the third-party extension and does not impact the core ScreenConnect software.

No prior authentication required.
Exploits default API secret.
Risk of unauthorized agent command execution.

Live Threat

Current exploitation, exposure, and threat context

Environments using the third-party RMM+ extension for ConnectWise ScreenConnect with the default static API secret could allow unauthorized actors to send commands to managed agents. This is supported when the default secret has not been changed by an administrator.

Extension API functionality.
Unauthorized API access with default secret.
Commands sent to managed agents.

Operational Fix

Recommended remediation, mitigation, and detection steps

The RMM+ extension for ConnectWise ScreenConnect, specifically when retaining the default static API secret, poses a risk of unauthorized command execution on managed agents. Ownership for addressing this vulnerability likely falls to the teams managing the ConnectWise ScreenConnect environment, including application administrators and potentially infrastructure or security teams responsible for the RMM platform. The first practical step is to confirm if the RMM+ extension is deployed, if the default API secret is in use, and if the ConnectWise ScreenConnect server is externally accessible.

Confirm extension deployment and default secrets.
Identify accountable ConnectWise administrators.
Plan remediation based on exposure risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the RMM+ extension for ConnectWise ScreenConnect?

ConnectWise ScreenConnect is a remote monitoring and management platform that technicians use to provide support and control over managed devices. The RMM+ extension is an optional, third-party add-on installed into this environment to provide additional management capabilities. This vulnerability is isolated to this specific extension and does not originate from or affect the underlying ScreenConnect server or client software.

What does CWE-1392 mean for CVE-2026-127063?

This vulnerability is classified as CWE-1392, which relates to the use of hard-coded, default, or predictable secrets for authentication. In this case, the extension relies on a static, default API secret that is likely the same across all installations. Because this secret is easily guessed or known, it fails to verify the identity of anyone attempting to interact with the extension's API, allowing unauthorized access to its functions.

Does this vulnerability trigger if I changed the default secret?

No. The flaw is specifically tied to the use of the default, static secret provided with the extension. If an administrator has manually updated this secret to a unique, custom value, the vulnerability cannot be triggered in the same way. The risk only persists in environments where the configuration remains in its initial state without applying a custom secret.

How do I know if my system is at risk?

According to Halo Surface Signal, because this extension integrates with remote management servers, these portals are frequently exposed to the internet to allow for remote access. If you have the RMM+ extension installed and it is reachable from the public internet while using the default secret, unauthorized users could reach the API to send commands to your managed agents. Systems without this extension are not at risk.

How should I respond to this vulnerability?

The first priority is to audit your environment to determine if the RMM+ extension is currently deployed. If you identify the extension, verify whether the default API secret is still in use. If the default secret is active, update it immediately to a strong, unique value. Administrators should ensure that any management interfaces exposed to the internet are properly secured and monitored for unauthorized access.

References

github.com/ConnectWise-Advisories/Disclosures/tree/main/CVE-2026…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.