The third-party RMM+ extension for ConnectWise ScreenConnect uses a static API secret by default. If the default secret is not changed by an administrator, unauthorized users may gain access to the extension's API functionality, including sending commands to managed agents. This vulnerability affects only the third-party extension and not the core ScreenConnect server or client software.