ScreenConnect Partners Told to Avoid SCKit Sessions

Partners using ScreenConnect should treat suspected hosts as unsafe for an interactive remote session. ConnectWise’s advisory, first published at 22:45 GMT on 11 November 2026 and updated at 02:45 GMT on 12 November, tells partners to investigate through separate security tooling, to avoid interactive ScreenConnect connections to devices thought to be compromised, and to include technician workstations that connected to those devices in the assessment. Access should be secured from a trusted device: revoke active ScreenConnect and identity-provider sessions, reset the relevant credentials, enforce MFA, use unique passwords, and remove unnecessary administrative access. On-premises partners are told to disable the listed third-party extensions themselves, because ConnectWise cannot do that for them, and to leave those extensions disabled pending further guidance.

That advice comes first because ConnectWise says it “does not have visibility or telemetry into activity within partner environments following initial access.” Partners have to assess their own estates. Huntress, which updated its post at 04:34 GMT on 12 November (11:34pm Eastern Time on 11 November), makes the same operational point in sharper terms: an interactive session to a suspected host can be dangerous, so responders should use EDR live response, WinRM, or another out-of-band tool, isolate the host, and rotate credentials from a clean device.

What ConnectWise has found, and what it has not

ConnectWise is “investigating reports of unauthorized access to certain partner ScreenConnect environments.” “At this time, we have found no evidence of a compromise of ConnectWise infrastructure or a vulnerability in ScreenConnect itself.” Its initial assessment “suggests the activity may involve a threat actor’s abuse of independent third-party extensions installed in partner environments.” The initial access method and the full scope “remain under investigation.”

The company identified “approximately 400 partner environments” with at least one independently developed third-party extension from the RMM+ family installed. “Their presence alone does not establish compromise.” ConnectWise says it has disabled the extensions in those environments wherever it can take action, and it repeats that this “represents environments with the extensions installed,” not a finding that those partners were compromised. The five extensions named for precautionary disabling are Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link and RMM+ Password Link. The extensions, ConnectWise says, provide an API capable of executing remote commands, with access protected by a passphrase the partner sets during setup.

Huntress’s figures are narrower and should not be collapsed into that 400. It reports “at least 288 managed endpoints across 48 organizations” that use Huntress. Suspicious activity was seen from “approximately 17:47 UTC” (17:47 GMT) on 11 November 2026, and all 288 hosts were hit “over the course of 90 minutes,” about a third of them in the first 10 minutes. Huntress says an operator used access to multiple cloud-hosted ScreenConnect panels to push commands that installed attacker-controlled ScreenConnect clients and a toolkit it calls SCKit.

Huntress also offers its own analysis of how that access may have worked. It says RMM+ versions 1.0.31 and 1.0.32 “would accept a blank” access key if an administrator had never configured one. That finding is Huntress’s. ConnectWise still says the access method is under investigation and that it has not found a vulnerability in ScreenConnect itself. Huntress separately writes that “the most current versions of the remote monitoring and management (RMM) software—26.6.6.9747 and 26.7.6.9783—are affected.” That, too, is Huntress’s claim, and it sits beside ConnectWise’s statement that no ScreenConnect vulnerability has been found.

Sophos X-Ops says it has observed unauthorised ScreenConnect client deployments, including a case in which an installer was written to C:\Windows\TEMP\sc.msi and installed silently. Sophos tells organisations using ScreenConnect to follow the ConnectWise advisory and to review command history for unexpected client deployments or remote commands.

This is a different incident from ConnectWise’s October Cloud Backup breach, in which a Microsoft 365 tenant used for that backup product was involved. It is closer in kind to later follow-on reporting around Storm-0940 activity after a previous ConnectWise incident, in that partners are being asked to assume that access inside their own tools may already have been abused. The practical rhyme with TeamViewer’s recent remote-access flaw is the same defensive one: a remote-support session is not a safe place to do the investigation.

The first job is to stop using the suspect session

The facts that matter for readers running ScreenConnect are already in the official guidance, and they are tighter than the largest headline numbers. ConnectWise has not reported a flaw in ScreenConnect or a breach of its own infrastructure. The 400 figure is the count of partner environments in which an RMM+ family extension was installed, not a tally of established compromises. Huntress’s 288 endpoints across 48 organisations are the hits it recorded in its own customer base, seen in a 90-minute window on 11 November. The blank-key analysis of RMM+ 1.0.31 and 1.0.32, and the claim that current ScreenConnect builds 26.6.6.9747 and 26.7.6.9783 are affected, should be quoted as Huntress’s, not as a ConnectWise finding.

Until the access method is settled, the useful work is the response ConnectWise and Huntress have already published: stay off interactive sessions to suspected hosts, use separate tools, revoke sessions, reset credentials from a trusted device, enforce MFA, and disable the five named extensions, especially on on-premises servers. The initial access path and the full scope are still under investigation.

Sources

ConnectWise, “ScreenConnect security advisory: Precautionary extension disabling and partner guidance,” published 11 November 2026, 22:45 GMT, updated 12 November 2026, 02:45 GMT. https://www.connectwise.com/company/trust/advisories
Huntress, “SCKit worm and rogue ScreenConnect,” 11 November 2026, updated 12 November 2026, 04:34 GMT. https://www.huntress.com/blog/sckit-worm-rogue-screenconnect
Sophos X-Ops, “Malicious ScreenConnect deployments observed.” https://www.sophos.com/en-us/blog/malicious-screenconnect-deployments-observed