CVE-2026-127063
Received Received - Intake

Static API Secret in ConnectWise ScreenConnect RMM+ Extension

Publication date: 2026-11-12

Last updated on: 2026-11-12

Assigner: ConnectWise

Description
The third-party RMM+ extension for ConnectWise ScreenConnect uses a static API secret by default. The value can be changed by an administrator; however, environments retaining the default value may allow unauthorized access to extension API functionality, including the ability to send commands to managed agents. This issue is specific to the third-party extension and does not affect the ScreenConnect server or client. Scope: This issue affects the third-party RMM+ extension for ConnectWise ScreenConnect. Deployments without the extension are not affected. ScreenConnect server or client software are not impacted.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-12
Last Modified
2026-11-12
Generated
2026-11-12
AI Q&A
2026-11-12
EPSS Evaluated
N/A
NVD
CVE-2026-127063
EUVD
EUVD-2026-124597

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
connectwise rmm_extension *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1392 The product uses default credentials (such as passwords or cryptographic keys) for potentially critical functionality.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a third-party RMM+ extension for ConnectWise ScreenConnect that uses a static default API secret. If not changed, this default secret allows unauthorized access to the extension's API functions, including sending commands to managed agents. The issue is specific to the RMM+ extension and does not affect the ScreenConnect server or client software.

Detection Guidance

Check for the presence of the DataComm RMM+ extension in your ConnectWise ScreenConnect environment. Verify if the default API secret is still in use by inspecting extension configuration files or API settings.

Impact Analysis

Unauthorized access to the extension's API could allow attackers to send commands to managed agents, potentially leading to system compromise or data breaches. Environments retaining the default API secret are at risk.

Mitigation Strategies

Disable the DataComm RMM+ extension immediately if it is installed. ConnectWise has disabled it in cloud environments, and on-premises users should follow suit. No patch is available; disabling is the only mitigation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-127063. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...