ConnectWise Automate Vulnerabilities Allowing Fake Updates and Unencrypted Communications

ConnectWise Automate, a widely used IT management platform, was found to contain two critical vulnerabilities, CVE-2025-11492 and CVE-2025-11493, which were addressed in the security update for version 2025.9. The first vulnerability, CVE-2025-11492, is rated with a CVSS score of 9.6 and arises from agents transmitting data without encryption when configured to use HTTP instead of HTTPS. This flaw allows attackers with network access to intercept or modify unencrypted communications, potentially exposing sensitive credentials or commands. The second vulnerability, CVE-2025-11493, with a CVSS score of 8.8, is due to missing integrity verification during the update process. This could enable attackers to inject malicious or tampered update files that appear legitimate, leading to unauthorized code execution on managed systems. Both vulnerabilities primarily affect on-premises deployments of ConnectWise Automate running versions prior to 2025.9. ConnectWise published a security advisory on October 16, 2025, urging customers to update to version 2025.9 to mitigate these risks. The Canadian Centre for Cyber Security also issued an alert, recommending that users and administrators review the advisories and apply the necessary updates immediately. The flaws highlight the risks associated with improper use of unsecured communication protocols and the lack of integrity checks in software update mechanisms. Organizations hosting on-premises Automate servers are particularly at risk if they have not yet applied the latest security fixes. The vulnerabilities could be exploited by attackers already present within the network, emphasizing the importance of internal network security and monitoring. The exposure of credentials or the ability to execute unauthorized code could lead to further compromise of managed endpoints. Security experts recommend that organizations not only update their ConnectWise Automate installations but also review their network configurations to ensure encrypted communications are enforced. The advisories stress the urgency of patching, as threat actors may attempt to weaponize these vulnerabilities quickly. The incident underscores the broader need for robust security practices in IT management platforms, which are often high-value targets for attackers. ConnectWise has provided detailed guidance and links to the latest advisories to assist customers in remediation. The vulnerabilities serve as a reminder of the importance of secure software development and regular security assessments for critical infrastructure tools. Organizations are advised to monitor for signs of exploitation and to implement additional controls where possible to mitigate the risk of similar vulnerabilities in the future.