EUVD-2026-23875
GHSA-h2v9-xpqq-69hx
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Lifecycle Timeline
5DescriptionCVE.org
ConnectWise has released a security update for ConnectWise Automate™ that addresses a behavior in the ConnectWise Automate Solution Center where certain client-to-server communications could occur without transport-layer encryption. This could allow network‑based interception of Solution Center traffic in Automate deployments. The issue has been resolved in Automate 2026.4 by enforcing secure communication for affected Solution Center connections.
AnalysisAI
Unencrypted client-server communications in ConnectWise Automate Solution Center expose sensitive data to network interception in all versions before 2026.4. Remote authenticated attackers with network access can capture Solution Center traffic containing potentially high-value confidential information (CVSS:3.1 C:H). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires valid low-privilege credentials to a ConnectWise Automate instance (PR:L) and network positioning to intercept traffic between Solution Center clients and servers. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is MODERATE-HIGH for MSP environments despite the 7.1 CVSS score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with low-privilege credentials to a ConnectWise Automate instance (obtained via phishing, credential stuffing, or insider access) positions a network sniffer on the same network segment as Solution Center client-server communications. The attacker passively captures unencrypted traffic flows containing administrative commands, customer environment credentials, or configuration data transmitted between Solution Center components. … |
| Remediation | Upgrade to ConnectWise Automate version 2026.4 or later, which enforces transport-layer encryption for all affected Solution Center connections per the vendor bulletin at https://www.connectwise.com/company/trust/security-bulletins/2026-04-20-connectwise-automate-bulletin. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all ConnectWise Automate Solution Center deployments and identify which versions are deployed (all versions before 2026.4 are affected). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today