Quick answers
- Is CVE-2026-127063 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-127063 being exploited in the wild.
- How severe is CVE-2026-127063?
- Informational severity, published 12 November 2026.
- Which products and versions are affected?
- ConnectWise ScreenConnect RMM+ extension.
- Is there a fix for CVE-2026-127063?
- No fixed version is recorded yet. Disable the RMM+ extension immediately in all on-premises deployments and verify it remains disabled pending official guidance from ConnectWise. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-127063 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-127063?
- Check whether you run ConnectWise ScreenConnect RMM+ extension. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
Disable the RMM+ extension immediately in all on-premises deployments and verify it remains disabled pending official guidance from ConnectWise.
Technical details
The RMM+ extension implements API authentication via a static shared secret that defaults to a known value; attackers can exploit this with network access to send commands to managed agents if the default secret has not been changed. The vulnerability is an authentication bypass due to hardcoded credentials (CWE-1392); cloud deployments are unaffected as ConnectWise has disabled the extension, but on-premises deployments retaining the default configuration are fully exploitable over the network without authentication or user interaction. No fix has been released; disabling the extension is the only mitigation.
Affected products
- ConnectWise ScreenConnect RMM+ extension
Timeline
- 2026-11-12: disclosed