CVE-2026-127063
The third-party RMM+ extension for ConnectWise ScreenConnect uses a static API secret by default. The value can be changed by an administrator; however, environments retaining the default value may allow unauthorized access to extension API functionality, including the ability to send commands to managed agents. This issue is specific to the third-party extension and does not affect the ScreenConnect server or client. Scope: This issue affects the third-party RMM+ extension for ConnectWise ScreenConnect. Deployments without the extension are not affected. ScreenConnect server or client software are not impacted.
| CWE | CWE-1392 |
| Vendor | datacomm |
| Product | rmm+ |
| Published | Nov 12, 2026 |
| Last Updated | Nov 13, 2026 |
Get instant alerts for datacomm rmm+
Be the first to know when new unknown vulnerabilities affecting datacomm rmm+ are published — delivered to Slack, Telegram or Discord.