Loading story…
A critical vulnerability, tracked as CVE-2025-11492 with a CVSS score of 9.6, was identified in the ConnectWise Automate Agent, allowing for man-in-the-middle (MitM) attacks due to improper HTTP configuration and lack of enforced encryption in transit. The flaw enables agent communications to be configured over HTTP instead of HTTPS, exposing sensitive agent-server traffic to interception, modification, or replay by an attacker positioned on the network path. Security researchers highlighted that the encryption method used to obfuscate some communications over HTTP was insufficient, prompting ConnectWise to release the Automate 2025.9 patch, which enforces HTTPS for all agent communications. This vulnerability could allow attackers to gain unauthorized access to sensitive information or manipulate agent-server interactions, posing significant risks to managed service providers and their clients. The issue was disclosed publicly in mid-October 2025, with both security advisories and vulnerability databases emphasizing its critical nature. The vulnerability does not allow for remote exploitation without network access, but it significantly increases risk in environments where HTTP is used. ConnectWise responded by updating their software to mandate secure communication channels, thereby mitigating the risk of MitM attacks. The flaw affects all versions of the Automate Agent where HTTP was permitted, though specific affected versions were not detailed in the advisories. Organizations using ConnectWise Automate are urged to apply the latest patches immediately to ensure all agent communications are encrypted. The vulnerability underscores the importance of enforcing secure transport protocols in remote monitoring and management (RMM) tools. Security experts warn that failure to address this issue could result in data breaches, unauthorized command execution, or further compromise of managed endpoints. The incident has prompted broader discussions about the security of RMM platforms and the need for robust verification of agent-server communications. While no active exploitation has been reported at the time of disclosure, the high severity rating reflects the potential impact if left unremediated. ConnectWise has provided guidance for customers to verify their configurations and ensure compliance with the new security requirements. The vulnerability is distinct from, but related to, another flaw (CVE-2025-11493) affecting the self-update verification mechanism, which is mitigated by enforcing HTTPS as addressed in CVE-2025-11492.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Public reporting described CVE-2025-11492 as a critical ConnectWise Automate flaw with a CVSS score of 9.6. The report said the issue could allow a man-in-the-middle attack against remote monitoring and management agents.
A high-severity vulnerability, CVE-2025-11492, affecting ConnectWise Automate was publicly disclosed. The flaw involves HTTP configuration and encryption in transit and was later described as enabling a man-in-the-middle attack against RMM agents.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ConnectWise Automate, a widely used IT management platform, was found to contain two critical vulnerabilities, CVE-2025-11492 and CVE-2025-11493, which were addressed in the security update for version 2025.9. The first vulnerability, CVE-2025-11492, is rated with a CVSS score of 9.6 and arises from agents transmitting data without encryption when configured to use HTTP instead of HTTPS. This flaw allows attackers with network access to intercept or modify unencrypted communications, potentially exposing sensitive credentials or commands. The second vulnerability, CVE-2025-11493, with a CVSS score of 8.8, is due to missing integrity verification during the update process. This could enable attackers to inject malicious or tampered update files that appear legitimate, leading to unauthorized code execution on managed systems. Both vulnerabilities primarily affect on-premises deployments of ConnectWise Automate running versions prior to 2025.9. ConnectWise published a security advisory on October 16, 2025, urging customers to update to version 2025.9 to mitigate these risks. The Canadian Centre for Cyber Security also issued an alert, recommending that users and administrators review the advisories and apply the necessary updates immediately. The flaws highlight the risks associated with improper use of unsecured communication protocols and the lack of integrity checks in software update mechanisms. Organizations hosting on-premises Automate servers are particularly at risk if they have not yet applied the latest security fixes. The vulnerabilities could be exploited by attackers already present within the network, emphasizing the importance of internal network security and monitoring. The exposure of credentials or the ability to execute unauthorized code could lead to further compromise of managed endpoints. Security experts recommend that organizations not only update their ConnectWise Automate installations but also review their network configurations to ensure encrypted communications are enforced. The advisories stress the urgency of patching, as threat actors may attempt to weaponize these vulnerabilities quickly. The incident underscores the broader need for robust security practices in IT management platforms, which are often high-value targets for attackers. ConnectWise has provided detailed guidance and links to the latest advisories to assist customers in remediation. The vulnerabilities serve as a reminder of the importance of secure software development and regular security assessments for critical infrastructure tools. Organizations are advised to monitor for signs of exploitation and to implement additional controls where possible to mitigate the risk of similar vulnerabilities in the future.
Jun 29, 2026
Ivanti released fixes for a newly disclosed high-severity flaw in its on-premises Endpoint Manager Mobile (**EPMM**) platform, tracked as `CVE-2026-6973`, after confirming limited zero-day exploitation. The vulnerability is caused by improper input validation and can lead to arbitrary code execution when a remote attacker already has administrator-level access. Ivanti said the issue affects EPMM `12.8.0.0` and earlier and issued patched versions `12.6.1.1`, `12.7.0.1`, and `12.8.0.1`, while urging customers to review privileged accounts and rotate credentials. The disclosure adds to a longer pattern of Ivanti security incidents: CISA previously warned that `CVE-2023-35082`, a critical authentication bypass flaw in Ivanti EPMM and MobileIron Core, was being actively exploited to gain unauthenticated API access, expose user data, and potentially backdoor servers when chained with other vulnerabilities. ConnectWise also disclosed a critical vulnerability in **ConnectWise Automate**, tracked as `CVE-2026-9089`, affecting versions prior to `2026.5`. The flaw, classified as `CWE-494`, stems from insufficient integrity verification during plugin loading and self-update operations and could allow malicious code execution on client machines during agent updates under specific network conditions. ConnectWise assigned the issue a CVSS score of **8.8**, automatically updated cloud deployments, and instructed on-premises customers to manually upgrade to version `2026.5`; Canada’s Cyber Centre separately urged administrators to apply the vendor update. The disclosures highlight continued risk across widely deployed enterprise management platforms, with internet exposure data showing hundreds of Ivanti EPMM systems and broad operational dependence on remote monitoring and mobile device management software.
Jun 29, 2026
ConnectWise released a security update for ScreenConnect to address a critical vulnerability, tracked as CVE-2025-14265, which affects the server component of the remote access platform. The flaw, caused by improper code integrity validation during extension installations (CWE-494), could allow attackers with authorized or administrative access to expose sensitive configuration data and install untrusted extensions. The vulnerability carries a CVSS 3.1 base score of 9.1, highlighting its severity, though ConnectWise reports no evidence of active exploitation at this time. The issue impacts all ScreenConnect versions prior to 25.8, and the 25.8 patch enforces stricter server-side validation and integrity checks for extension installations. ConnectWise has automatically applied updates to cloud-hosted ScreenConnect instances, while on-premises users must manually upgrade to version 25.8. Partners using Automate integration are advised to update their Automate ScreenConnect Extension before upgrading ScreenConnect itself. Security advisories from both ConnectWise and the Canadian Centre for Cyber Security urge organizations to prioritize patching to prevent potential unauthorized access and maintain secure remote management environments. The vulnerability is rated as Priority 2 – Moderate, with a recommended update window of 30 days, but immediate action is encouraged due to the risk of sensitive data exposure.
Jun 29, 2026