CVE-2025-11492

CriticalCVSS 9.6

Published: 16/10/2025(UTC)Updated: 09/10/2026(UTC)Translated: 09/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

10th percentile - higher than 10% of all known CVEs

Summary

In the ConnectWise Automate Agent, communications could be configured to use HTTP instead of HTTPS. In such cases, an on-path threat actor with a man-in-the-middle network position could intercept, modify, or replay agent-server traffic. The Automate 2025.9 patch enforces HTTPS for all agent communications.

Risk Assessment

An attacker on the network could intercept sensitive data transmitted between the agent and server, and modify communications, potentially leading to unauthorized actions on managed endpoints. The threat affects organizations that have not enforced HTTPS in the agent configuration.

Recommendation

Update ConnectWise Automate to version 2025.9 or later, which enforces HTTPS. Until then, ensure the agent configuration uses only HTTPS.

Other vulnerabilities in ConnectWise Automate Agent

CVE-2025-11493High
The ConnectWise Automate Agent does not fully verify the authenticity of files downloaded from the server, such as updates, dependencies, and integrations. This creates a risk where an on-path attacker could perform a man-in-the-middle attack and substitute malicious files for legitimate ones by impersonating a legitimate server. This risk is mitigated when HTTPS is enforced and is related to CVE-2025-11492.

Original NVD description (English source)

In the ConnectWise Automate Agent, communications could be configured to use HTTP instead of HTTPS. In such cases, an on-path threat actor with a man-in-the-middle network position could intercept, modify, or replay agent-server traffic. Additionally, the encryption method used to obfuscate some communications over the HTTP channel is updated in the Automate 2025.9 patch to enforce HTTPS for all agent communications.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS