# ScreenConnect investigation finds extension flaw and limits of SCKit exploit

_Published Thursday, November 12, 2026 at 12:57 PM EST · Security · Latest · Tier 2 — Notable_

![ScreenConnect investigation finds extension flaw and limits of SCKit exploit — Primary](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh4r5n0I6Rd7yb3jS6hfXTyM5foZU5uEiCD1I2Kgth1qgf_pzohrD9jPeDesEopB6Gjo0VaQZF2XesdqU6W32eFADzI3_xhBF4026h6uGqn6eExdfS_A29SvYA3cdIJkhWmPG-k15_DdsGGcqFfWS-E3cgyKkdEQ3Sxa9gayFkkMXggVJpkeH7DoLNLZxm9/s1700-nu-rw-lo-l85-e365/screen.jpg)

Huntress identified an authentication flaw in RMM+ versions 1.0.31 and 1.0.32, a third-party ScreenConnect extension: when administrators had not configured an access key, it accepted a blank key, potentially allowing unauthorized commands. ConnectWise has disabled five extensions where it can and advised on-premises partners to disable them immediately.

Separately, Blackpoint Cyber confirmed that SCKit targets the already-patched CVE-2026-84869 and that patched clients block its exploit payload. The toolkit also attempts to steal authenticated technician sessions and use their permissions to reach other managed endpoints.

Initial access remains unconfirmed. Investigators have no evidence of successful propagation to a technician workstation or a bypass of the vendor patch.

## Sources

- [The Hacker News](https://thehackernews.com/2026/11/sckit-malware-targets-screenconnect.html)

---
Canonical: https://techandbusiness.org/newswire/rkaEQs9Wanp21F7neotCrQ
Published: 2026-11-12T17:57:31.180Z
Story chronology: 2026-11-12T13:08:00.000Z
Retrieved: 2026-11-12T19:49:31.787Z
Publisher: Tech & Business (techandbusiness.org)