# ConnectWise disables five extensions after unauthorized access reports

_Published Thursday, November 12, 2026 at 1:06 AM EST · Security · Latest · Tier 2 — Notable_

![ConnectWise disables five extensions after unauthorized access reports — Primary](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgEfz7InYm8UO-p35K6B4j009BxA-MO7DdZ2x1d-xhyphenhyphenPxNnVs848IlgAGelmuW-sPbEZbE8-L9_KWEYNH_M5HaTMy14MFd87A7YkqHAzDKaamKOdpZKR9owL3nK3gbqAngvWa6A4NC1KK1l0ie9FK731LfKPI0lguiGQ1b71sHIZj2kR2H3I-GJjSPY4kJU/s1700-nu-rw-lo-l85-e365/screenconnect-hack.jpg)

ConnectWise has disabled five third-party extensions in partner environments following reports of unauthorized access. Huntress said attackers used cloud-hosted ScreenConnect panels to deploy rogue remote-access clients on at least 288 managed endpoints across 48 organizations.

The extensions expose an API for remote commands protected by a partner-configured passphrase. ConnectWise identified about 400 partner environments with at least one extension installed, while stressing that installation alone does not establish compromise. It urged on-premises partners to disable the extensions.

Huntress said the malicious toolkit can steal sessions and attempt further spread, but it has not observed a successful jump from an infected endpoint to a technician's workstation. Initial access remains under investigation; ConnectWise says it has no evidence of compromised company infrastructure or a ScreenConnect vulnerability.

## Sources

- [The Hacker News](https://thehackernews.com/2026/11/screenconnect-attacks-target-at-least.html)

---
Canonical: https://techandbusiness.org/newswire/iMD0pVkaHPGsZXF2JQp148
Published: 2026-11-12T06:06:15.547Z
Story chronology: 2026-11-12T04:39:00.000Z
Retrieved: 2026-11-12T07:27:24.858Z
Publisher: Tech & Business (techandbusiness.org)