ConnectWise Automate CVE-2025-11492

Exploitation requires three concrete conditions: (1) the Automate Agent must be configured to use HTTP instead of HTTPS for agent-server communications - the 2025.9 patch exists precisely to enforce HTTPS, implying HTTP transport is the vulnerable configuration; (2) the attacker must already hold an on-path/man-in-the-middle network position between agent and server (reflected by AV:A adjacent and AC:H); and (3) the attacker must defeat the weak obfuscation applied to some HTTP-channel communications, which is not true encryption. Limiting factors: no exploitation is possible against agents already using HTTPS, no user interaction is needed (UI:N) and no authentication is needed (PR:N), but the mandatory MITM positioning plus HTTP-mode dependency make opportunistic or internet-wide exploitation impractical.

Signals point to a credible-but-conditional risk rather than a drop-everything priority. The CVSS 3.1 vector (AV:A/AC:H/PR:N/UI:N, C:H/I:H/A:H, base 7.5) describes an unauthenticated adjacent-network attack of HIGH complexity with full CIA impact - the high complexity reflects that the attacker must both occupy a man-in-the-middle position AND find agents configured for HTTP rather than HTTPS. These prerequisites sharply constrain mass exploitation, which is consistent with the low EPSS score of 0.21% (10th percentile). There is no CISA KEV listing and no public exploit identified in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' The signals are internally consistent (no conflict between a low EPSS and the absence of KEV/POC). The one point meriting verification: the CVSS marks this AV:A (adjacent) rather than AV:N, yet an on-path attacker's reachability depends on network topology between agent and server - if agent-server traffic traverses untrusted/internet segments, real-world exposure could be broader than 'adjacent' implies; verify the actual network path with the deployment owner. Because ConnectWise Automate is an RMM platform, successful tampering/replay of agent-server traffic is high-consequence (potential control over managed endpoints), so despite the low probability it warrants prompt patching to Automate 2025.9 where HTTP transport is in use.

An attacker who has already gained a man-in-the-middle position on a network segment carrying ConnectWise Automate agent traffic observes an agent configured to communicate over HTTP instead of HTTPS. Because the channel is cleartext (weakly obfuscated rather than encrypted), the attacker intercepts, modifies, or replays agent-server messages to read sensitive data or inject commands toward the managed endpoint. No public exploit code is identified at time of analysis, so this would require custom tooling and an existing network foothold.