ConnectWise Disables Five ScreenConnect Extensions After Unauthorized Partner Account Access
On November 11, 2026, ConnectWise disabled five third-party ScreenConnect extensions in approximately 400 partner environments following unauthorized access to partner accounts. While ConnectWise has not named an attacker or discovered the initial access vector, the extensions are suspected to have played a role in enabling attackers to use ScreenConnect features to deploy other remote-access software within customer environments. There are reports of potential compromise of technician workstations during live sessions, but these remain unconfirmed by ConnectWise. Amidst this, the company urges all partners to disable these extensions if installed, reset credentials, enforce multi-factor authentication, and monitor logs to mitigate further risk. The breach risks affecting numerous customer networks managed by the compromised partners, making it critical to act promptly.
Linha do tempo
-
ConnectWise Disables Five ScreenConnect Extensions After Unauthorized Partner Account Access
ler a análise desta fonte ocultar
On November 11, 2026, ConnectWise disabled five third-party ScreenConnect extensions in approximately 400 partner environments following unauthorized access to partner accounts. While ConnectWise has not named an attacker or discovered the initial access vector, the extensions are suspected to have played a role in enabling attackers to use ScreenConnect features to deploy other remote-access software within customer environments. There are reports of potential compromise of technician workstations during live sessions, but these remain unconfirmed by ConnectWise. Amidst this, the company urges all partners to disable these extensions if installed, reset credentials, enforce multi-factor authentication, and monitor logs to mitigate further risk. The breach risks affecting numerous customer networks managed by the compromised partners, making it critical to act promptly.