published 2026-11-12
A weakness in the RMM+ extension may let attackers bypass MFA and issue commands through ScreenConnect as if they were technicians. Versions 1.0.31 and 1.0.32 that have no access key configured accept a blank one, so anyone reaching the extension can control the machine.
Source: theregister.com
FixLane has a reviewed fix procedure for this incident: a read-only check first, then the fix. Ask the Telegram bot, or connect an AI agent to the FixLane MCP server and call get_fix_prompt with incident id 2592 and your operating system.