Automate
Monthly
Code integrity failure in ConnectWise Automate Agent versions prior to 2026.5 allows adjacent network attackers to substitute malicious components during plugin loading and self-update operations. The Automate agent does not fully verify the authenticity of downloaded components, enabling code execution at the agent's privilege level across managed endpoints. No public exploit identified at time of analysis, though the high CVSS score of 8.8 and the agent's deep system access make this a priority remediation for MSPs using the platform.
Unencrypted client-server communications in ConnectWise Automate Solution Center expose sensitive data to network interception in all versions before 2026.4. Remote authenticated attackers with network access can capture Solution Center traffic containing potentially high-value confidential information (CVSS:3.1 C:H). No active exploitation confirmed at time of analysis. EPSS data unavailable for this recent CVE.
The ConnectWise Automate Agent fails to fully verify the authenticity of files it downloads from its management server - updates, dependencies, and integrations - so an on-path attacker who can intercept agent-to-server traffic over a non-HTTPS channel could substitute malicious files for legitimate ones and impersonate the server (CWE-494). Exploitation is conditional, not trivial: the attacker must already hold a man-in-the-middle position on the network path (CVSS AV:A) and the deployment must be communicating over plaintext HTTP, since the vendor states the risk is mitigated when HTTPS is enforced; those prerequisites drive the high attack complexity (AC:H) in the assessed vector CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; EPSS is only 0.23% (12th percentile), consistent with a real-but-conditional, moderate-priority issue rather than an emergency. The flaw is related to CVE-2025-11492 and affects the Automate Agent identified by CPE cpe:2.3:a:connectwise:automate.
ConnectWise Automate Agent deployments configured to send agent-server traffic over HTTP rather than HTTPS are exposed to man-in-the-middle interception, modification, and replay of that traffic; the underlying weakness is that the HTTP channel relies on an obfuscation scheme rather than true encryption (CWE-319, cleartext transmission). The flaw affects Automate agent installations running the legacy HTTP transport and is fixed in the 2025.9 release, which enforces HTTPS for all agent communications and updates the obfuscation method. No public exploit code has been identified and there is no CISA KEV listing; EPSS is low at 0.21% (10th percentile), and exploitation demands an on-path network position plus the non-default HTTP configuration, so the risk is credible but conditional rather than opportunistic.
SQL injection in the compliance service of Progress Chef Automate versions earlier than 4.13.295 on Linux x86 lets an attacker with low-privilege authenticated access reach restricted compliance functionality and execute arbitrary SQL, yielding high impact to confidentiality, integrity, and availability (CVSS 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires authenticated access combined with a 'well-known' token, but because that token is described as well-known, the effective authentication barrier is likely far weaker than the PR:L vector suggests; exploitation is further confined to the Linux x86 build and to releases below 4.13.295. Publicly available exploit code exists and EPSS is elevated at 17.32% (95th percentile), making this a credible operational priority rather than a merely paper-high CVSS; there is no CISA KEV confirmation of active exploitation.
In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functionality in multiple services via. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This SQL Injection vulnerability could allow attackers to execute arbitrary SQL commands against the database.
Upload profile either through API or user interface in Chef Automate prior to and including version 4.10.29 using InSpec check command with maliciously crafted profile allows remote code execution. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Connectwise Automate 2022.11 is vulnerable to Cleartext authentication. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Connectwise Automate 2022.11 is vulnerable to Clickjacking. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An XXE vulnerability exists in ConnectWise Automate before 2021.0.6.132. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Agent Update System in ConnectWise Automate before 2020.8 allows Privilege Escalation because the _LTUPDATE folder has weak permissions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
ConnectWise Automate through 2020.x has insufficient validation on certain authentication paths, allowing authentication bypass via a series of attempts. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Code integrity failure in ConnectWise Automate Agent versions prior to 2026.5 allows adjacent network attackers to substitute malicious components during plugin loading and self-update operations. The Automate agent does not fully verify the authenticity of downloaded components, enabling code execution at the agent's privilege level across managed endpoints. No public exploit identified at time of analysis, though the high CVSS score of 8.8 and the agent's deep system access make this a priority remediation for MSPs using the platform.
Unencrypted client-server communications in ConnectWise Automate Solution Center expose sensitive data to network interception in all versions before 2026.4. Remote authenticated attackers with network access can capture Solution Center traffic containing potentially high-value confidential information (CVSS:3.1 C:H). No active exploitation confirmed at time of analysis. EPSS data unavailable for this recent CVE.
The ConnectWise Automate Agent fails to fully verify the authenticity of files it downloads from its management server - updates, dependencies, and integrations - so an on-path attacker who can intercept agent-to-server traffic over a non-HTTPS channel could substitute malicious files for legitimate ones and impersonate the server (CWE-494). Exploitation is conditional, not trivial: the attacker must already hold a man-in-the-middle position on the network path (CVSS AV:A) and the deployment must be communicating over plaintext HTTP, since the vendor states the risk is mitigated when HTTPS is enforced; those prerequisites drive the high attack complexity (AC:H) in the assessed vector CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; EPSS is only 0.23% (12th percentile), consistent with a real-but-conditional, moderate-priority issue rather than an emergency. The flaw is related to CVE-2025-11492 and affects the Automate Agent identified by CPE cpe:2.3:a:connectwise:automate.
ConnectWise Automate Agent deployments configured to send agent-server traffic over HTTP rather than HTTPS are exposed to man-in-the-middle interception, modification, and replay of that traffic; the underlying weakness is that the HTTP channel relies on an obfuscation scheme rather than true encryption (CWE-319, cleartext transmission). The flaw affects Automate agent installations running the legacy HTTP transport and is fixed in the 2025.9 release, which enforces HTTPS for all agent communications and updates the obfuscation method. No public exploit code has been identified and there is no CISA KEV listing; EPSS is low at 0.21% (10th percentile), and exploitation demands an on-path network position plus the non-default HTTP configuration, so the risk is credible but conditional rather than opportunistic.
SQL injection in the compliance service of Progress Chef Automate versions earlier than 4.13.295 on Linux x86 lets an attacker with low-privilege authenticated access reach restricted compliance functionality and execute arbitrary SQL, yielding high impact to confidentiality, integrity, and availability (CVSS 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires authenticated access combined with a 'well-known' token, but because that token is described as well-known, the effective authentication barrier is likely far weaker than the PR:L vector suggests; exploitation is further confined to the Linux x86 build and to releases below 4.13.295. Publicly available exploit code exists and EPSS is elevated at 17.32% (95th percentile), making this a credible operational priority rather than a merely paper-high CVSS; there is no CISA KEV confirmation of active exploitation.
In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functionality in multiple services via. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This SQL Injection vulnerability could allow attackers to execute arbitrary SQL commands against the database.
Upload profile either through API or user interface in Chef Automate prior to and including version 4.10.29 using InSpec check command with maliciously crafted profile allows remote code execution. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Connectwise Automate 2022.11 is vulnerable to Cleartext authentication. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Connectwise Automate 2022.11 is vulnerable to Clickjacking. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An XXE vulnerability exists in ConnectWise Automate before 2021.0.6.132. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Agent Update System in ConnectWise Automate before 2020.8 allows Privilege Escalation because the _LTUPDATE folder has weak permissions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
ConnectWise Automate through 2020.x has insufficient validation on certain authentication paths, allowing authentication bypass via a series of attempts. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.