ConnectWise Automate CVE-2026-9089

Requires adjacent-network position (CVSS AV:A) - same broadcast domain or otherwise on-path between the Automate agent and its update/plugin source; not exploitable from arbitrary internet hosts. The target endpoint must be running ConnectWise Automate agent at a version prior to 2026.5 and must initiate a plugin loading or self-update operation during the attacker's window of presence. No authentication is required (PR:N), no user interaction is required (UI:N), and exploitation works against default configurations of vulnerable Automate agents since the missing integrity check is in the standard update/plugin flow. Limiting factors: the AV:A constraint rules out remote internet attackers without a network foothold, and the attacker must be able to intercept or redirect agent-to-server traffic (ARP spoofing, rogue gateway, DNS manipulation, or a compromised intermediate device).

The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates adjacent-network attack vector - not internet-wide - combined with low complexity, no privileges, and no user interaction, yielding high impact across confidentiality, integrity, and availability. Because the Automate agent is privileged endpoint management software deployed at scale across MSP customer estates, successful tampering during plugin/self-update flow effectively gives an attacker arbitrary code execution on every managed endpoint reachable from the compromised network segment - a meaningful supply-chain-style blast radius despite the AV:A restriction. No EPSS score, KEV listing, or SSVC decision data was provided in the input; CISA KEV status is therefore not confirmed and active exploitation cannot be claimed. The 'Information Disclosure' tag on the record is narrower than the CVSS impact triad suggests and may understate integrity risk - defenders should weight the CVSS vector and CWE-494 root cause over the tag. No public exploit identified at time of analysis, but the conceptual exploitation pattern (MITM or rogue update server on the same broadcast domain) is well-understood and tractable for a moderately skilled attacker.

An attacker with adjacent-network access - such as a foothold on a customer LAN, a compromised guest Wi-Fi segment, or a rogue device on the same broadcast domain as managed endpoints - positions themselves between the Automate agent and its update source via ARP poisoning, DHCP/DNS manipulation, or a rogue update endpoint. When the agent next initiates a plugin load or self-update, the attacker serves a malicious component that the agent fails to authenticate properly, resulting in code execution at the agent's privilege level on every endpoint that fetches the tampered payload. No public exploit identified at time of analysis, but the MITM-against-unsigned-update pattern is well documented and within reach of moderately skilled adversaries.