Blank Access Key Flaw in ScreenConnect Extension Lets Attackers Hijack Hundreds of Endpoints
Written by AI from the linked story. Not reviewed by an editor. How this works
Attackers exploited a critical authentication bypass vulnerability in the RMM+ ScreenConnect extension, where a blank access key was sufficient to circumvent security controls — a fundamental access control failure. Because RMM tools have privileged access to managed endpoints by design, a single compromised extension cascaded across 288 hosts in 48 organizations. The flaw existed in specific versions (1.0.31 and 1.0.32) that remained deployed in production environments, highlighting the danger of unpatched third-party extensions within trusted remote management platforms. This incident demonstrates that supply-chain-adjacent tooling — third-party extensions that plug into critical infrastructure — can become a force multiplier for attackers when not rigorously maintained and monitored.
Tactical Insight
Immediate actions
- Upgrade or remove RMM+ ScreenConnect extension versions 1.0.31 and 1.0.32 immediately and audit all third-party extensions for known vulnerabilities.
- Audit all ScreenConnect client installations across managed endpoints to identify and remove any rogue or unauthorized instances.
- Rotate and enforce strong, non-blank access keys for all ScreenConnect and RMM tool configurations.
Long-term improvements
- Establish a formal vetting and patch-tracking process for every third-party plugin or extension integrated into your RMM or remote access platform.
- Apply least-privilege principles to RMM tools so that compromised extensions cannot propagate actions across all managed endpoints without additional authorization.
- Maintain a continuously updated inventory of all remote access software and extensions deployed in your environment.
Detection measures
- Deploy behavioral monitoring to alert on unexpected ScreenConnect client installations or new remote session relays appearing on endpoints.
- Implement network-level logging of outbound connections from managed endpoints to detect session cookie relay activity indicative of SCKit-style toolkits.
- Subscribe to security advisories from your RMM and remote access vendors so critical extension vulnerabilities trigger an immediate response workflow.