ConnectWise Automate CVE-2025-11493

Exploitation requires (1) the attacker to already occupy an on-path/man-in-the-middle position on the network path between the Automate Agent and its server (adjacent access, AV:A), and (2) agent-server communication occurring over a non-HTTPS/plaintext channel - the vendor explicitly states the risk is mitigated when HTTPS is enforced, so a deployment that enforces HTTPS is not exploitable. The agent must then fetch an update, dependency, or integration that it accepts without fully verifying authenticity. Limiting factors: the MITM prerequisite plus the non-default-insecure (HTTP) transport condition yield high attack complexity (AC:H) and substantially narrow real-world exploitability despite no authentication or user interaction being required.

Signals are consistent and point to a real-but-conditional, moderate-priority issue rather than a drop-everything emergency. The CVSS 3.1 vector (AV:A/AC:H/PR:N/UI:N, C:H/I:H/A:H, score 7.5) shows that although no authentication or user interaction is needed, exploitation requires adjacent/on-path network positioning (AV:A) AND high attack complexity (AC:H) - the attacker must already hold a man-in-the-middle position and the deployment must not be enforcing HTTPS. EPSS reinforces low near-term likelihood at 0.23% (12th percentile). There is no CISA KEV listing and no POC referenced in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was supplied. The signals do not conflict: high potential impact (full compromise of the agent host via substituted/malicious files) offset by meaningful preconditions (MITM + plaintext channel). This is a defense-in-depth / supply-chain-integrity fix more than a widely-automatable mass-exploitation threat. Note: the input tag 'Information Disclosure' conflicts with the actual weakness (CWE-494, download of code without integrity check leading to code execution) - treat impact as integrity/code-execution, not primarily disclosure.

An attacker who has gained an on-path position on the network between a ConnectWise Automate Agent and its server (for example on a shared or compromised LAN/Wi-Fi segment) waits for the agent to request an update, dependency, or integration over an unencrypted channel. Because the agent does not fully verify file authenticity, the attacker impersonates the legitimate server and substitutes a malicious file, which the agent accepts and executes. No public exploit code was identified in the provided data, and the attack fails where HTTPS is enforced.