Loading vulnerability…
ConnectWise Automate Agent insecure HTTP agent communication
CVE-2025-11492 affects the ConnectWise Automate Agent when agent communications are configured to use HTTP rather than HTTPS. In that configuration, agent-server traffic is transmitted over an unencrypted channel susceptible to interception and manipulation by an attacker in an on-path man-in-the-middle position. The vendor also notes that some communications over the HTTP channel were only obfuscated with an encryption method that is being updated in Automate 2025.9, and the patch enforces HTTPS for all agent communications. The core issue is the use of cleartext/inadequately protected transport for sensitive agent-server communications, enabling interception, modification, or replay of traffic.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker with network-level on-path access can observe agent-server communications, tamper with messages in transit, and replay captured traffic. Depending on what data and commands are exchanged over the affected channel, this could expose sensitive management data, compromise the integrity of agent instructions or responses, and undermine trust in remote management operations. The vulnerability primarily impacts confidentiality and integrity of Automate agent communications, and may also enable follow-on compromise if manipulated traffic is accepted by either endpoint.
If you can’t patch tonight, do this now.
Until patching is complete, disable or prevent all HTTP-based agent communications wherever possible. Restrict agent-server traffic to trusted management networks, use network controls to block plaintext HTTP transport between agents and the Automate server, and monitor for signs of interception or anomalous agent traffic. If immediate upgrade is not possible, reduce exposure by segmenting management traffic and eliminating opportunities for on-path interception.
Patch, then assume compromise.
Apply the ConnectWise Automate 2025.9 patch or later, which enforces HTTPS for all agent communications and updates the protection previously used for some HTTP-channel communications. Ensure all Automate agent-server traffic is configured and verified to use HTTPS only. Review agent and server configuration to eliminate any legacy HTTP communication paths.
1 exploit validated by Mallory's analysis.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.