PULSEUnderground Intel

EN VIVO39señales / 24h

FEED

ransomvexy ransomware reclama a Franc-Oil · NG · Energy & Utilitiesransomvexy ransomware reclama a Osiiminppal · GLransomvexy ransomware reclama a Upper Web · BR · Technologyransomsafepay reclama a toyokiki-thailand.com · TH · Manufacturingransomincransom reclama a axiscades.com · IN · Manufacturingransomcurious worm reclama a benchmarkseniorliving.com · US · Healthcareransomaoqin reclama a Airblue · PK · Transportationransompanzer reclama a Ministry of Health Malaysia · MY · Government & Defenseransomkrybit reclama a cey-tech.com · CY · Technologyransommetaencryptor reclama a Promantra, Inc. · US · Technologyransomincransom reclama a CIMSA LOGISTICS · US · Transportationransomincransom reclama a HELP Foundation · US · Otherransomincransom reclama a gamechangerwm.com · US · Professional Servicesransomincransom reclama a raymondjames.com · US · Financial Servicesransomvexy ransomware reclama a Franc-Oil · NG · Energy & Utilitiesransomvexy ransomware reclama a Osiiminppal · GLransomvexy ransomware reclama a Upper Web · BR · Technologyransomsafepay reclama a toyokiki-thailand.com · TH · Manufacturingransomincransom reclama a axiscades.com · IN · Manufacturingransomcurious worm reclama a benchmarkseniorliving.com · US · Healthcareransomaoqin reclama a Airblue · PK · Transportationransompanzer reclama a Ministry of Health Malaysia · MY · Government & Defenseransomkrybit reclama a cey-tech.com · CY · Technologyransommetaencryptor reclama a Promantra, Inc. · US · Technologyransomincransom reclama a CIMSA LOGISTICS · US · Transportationransomincransom reclama a HELP Foundation · US · Otherransomincransom reclama a gamechangerwm.com · US · Professional Servicesransomincransom reclama a raymondjames.com · US · Financial Services

← Todos los CVEs

CVE Watch12 nov 2026

CVE-2026-127063

The third-party RMM+ extension for ConnectWise ScreenConnect uses a static API secret by default. The value can be changed by an administrat

CVSS

—

Sin CVSS

EPSS

—

KEV

—

Exploit Today

—

0-100

Publicado: 12 nov 2026 · Última mod.: 12 nov 2026 · CWE-1392

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

The third-party RMM+ extension for ConnectWise ScreenConnect uses a static API secret by default. The value can be changed by an administrator; however, environments retaining the default value may allow unauthorized access to extension API functionality, including the ability to send commands to managed agents. This issue is specific to the third-party extension and does not affect the ScreenConnect server or client. Scope: This issue affects the third-party RMM+ extension for ConnectWise ScreenConnect. Deployments without the extension are not affected. ScreenConnect server or client software are not impacted.

Referencias oficiales

github.comhttps://github.com/ConnectWise-Advisories/Disclosures/tree/main/CVE-2026-127063

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-1240068.1 ALT

———XWEB EVO through 5.8.8 contains a predictable credential generation vulnerability that allows attackers to derive the Linux root password by computing a fixed prefix combined with a daily password value. Attackers can calculate the deterministic root credential, which before 5.7.0 was identical across all units and from 5.7.0 onward remains derivable from the MAC-based daily password, to gain unauthorized root access to the underlying operating system. This product line reached it's end of service date in March 2026.6h CVE-2026-819366.8 MED

——0An internal security review identified a development regression from ThinkSystem v4 XClarity Controller 3 (XCC3) versions (2.51) IHX432Y to (2.56) IHX436K which re-introduces the default OpenBMC root password upon performing an XCC Reset to Default operation. An attacker can gain access to enabled administrative interfaces of XCC using the default OpenBMC credential re-introduced after Reset to Default. Additionally, this provides access to the underlying XCC Operating System which is not normally accessible. Only these versions are affected and are no longer available for download. Process enhancements have also been made to prevent and identify potential future regression.6h CVE-2026-111257—

——4With the default configuration and no users defined in the default user database, TomEE silently adds an administrative user with a well-known password at startup. A remote attacker can use these credentials to authenticate to web applications that use the default realm and grant access to any authenticated user or to the TomEE administrative role. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.11h CVE-2026-1253849.8 CRÍ

——13INDOTALENT WHMS before 10.20261109 contains a default credentials vulnerability that allows unauthenticated attackers to gain administrator access because UserAdminSeeder creates admin@root.com with password 123456. Attackers can log in with these credentials, which carry every admin role and no forced password change, to fully control deployments that kept them.7h CVE-2026-118792—

——0Default credentials permit access through AcuXDBC.8h CVE-2026-1235536.5 MED

——5OpenAM before 16.1.4 ships built-in identities in the Top Level Realm (demo, anonymous, wsc, wsp, SecurityTokenService and agentAuth) with passwords that are identical on every installation, publicly known, and able to authenticate. Unauthenticated remote attackers can log in as these identities to obtain authenticated sessions, and the agent identities can read the configuration of other agent profiles.2d