Loading vulnerability…
ConnectWise Automate Agent Download Integrity Verification Bypass
CVE-2025-11493 is a vulnerability in the ConnectWise Automate Agent caused by incomplete authenticity and integrity verification of files downloaded from the Automate server, including updates, dependencies, and integrations. Because the agent does not fully validate that retrieved files are genuine and untampered, an attacker positioned on the network path between the agent and server can impersonate a legitimate server and substitute malicious content for expected files. The issue is fundamentally a download-of-code-without-integrity-check condition in the agent’s update and component retrieval workflow, creating a path to execution of attacker-supplied code on managed endpoints.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can allow an attacker to inject malicious or tampered files into the agent’s download process and have them treated as legitimate components. This can lead to unauthorized code execution on managed systems, potentially with the privileges of the Automate Agent, and may enable compromise of confidentiality, integrity, and availability on affected endpoints.
If you can’t patch tonight, do this now.
Enforce HTTPS for all ConnectWise Automate Agent communications and require TLS 1.2 to reduce exposure to on-path interception and server impersonation attacks. Limit opportunities for adjacent-network manipulation by segmenting management traffic, protecting local networks against spoofing and interception, and monitoring agent update and component delivery workflows for anomalous file substitution behavior. Where immediate patching is not possible, reducing attacker access to the relevant network path is the primary compensating control.
Patch, then assume compromise.
Apply the vendor-provided fix for CVE-2025-11493 as soon as it is available in the relevant ConnectWise Automate release stream. For on-premises deployments, follow ConnectWise guidance to enforce HTTPS for all agent communications and ensure TLS 1.2 is enforced. Validate that agent update, dependency, and integration delivery paths use authenticated and encrypted transport, and prioritize upgrading any legacy configurations that permit unauthenticated or insufficiently protected file retrieval.
1 exploit validated by Mallory's analysis.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.