ScreenConnect investigation finds extension flaw and limits of SCKit exploit

Huntress identified an authentication flaw in RMM+ versions 1.0.31 and 1.0.32, a third-party ScreenConnect extension: when administrators had not configured an access key, it accepted a blank key, potentially allowing unauthorized commands. ConnectWise has disabled five extensions where it can and advised on-premises partners to disable them immediately. Separately, Blackpoint Cyber confirmed that SCKit targets the already-patched CVE-2026-84869 and that patched clients block its exploit payload. The toolkit also attempts to steal authenticated technician sessions and use their permissions to reach other managed endpoints. Initial access remains unconfirmed. Investigators have no evidence of successful propagation to a technician workstation or a bypass of the vendor patch.