Loading vulnerability…
CVE-2025-11493 is a vulnerability in the ConnectWise Automate Agent caused by incomplete authenticity and integrity verification of files downloaded from the Automate server, including updates, dependencies, and integrations. Because the agent does not fully validate that retrieved files are genuine and untampered, an attacker positioned on the network path between the agent and server can impersonate a legitimate server and substitute malicious content for expected files. The issue is fundamentally a download-of-code-without-integrity-check condition in the agent’s update and component retrieval workflow, creating a path to execution of attacker-supplied code on managed endpoints.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository implements a full adversary-in-the-middle (AiTM) exploit for ConnectWise Automate (LabTech) agent vulnerabilities (CVE-2025-11492, CVE-2025-11493). The exploit targets agents configured to use HTTP (unencrypted) communication, allowing an attacker with network access to impersonate the legitimate Automate server and deliver a malicious plugin to the agent. The repository is structured as follows: - The main exploit logic is in `automate_server/main.py`, which implements a FastAPI server emulating the Automate server endpoints. It handles the agent's dependency checks, serves a malicious plugin DLL, and manages command-and-control (C2) operations. - `automate_server/labtech_enums.py` and `labtech_net.py` provide enum mappings and .NET interop for agent command IDs and encryption routines. - `automate_server/deps_LabTech_Agent_v250.249.xml` is a sample dependency list used to trigger plugin updates. - `mitm_automate.py` is a mitmproxy script to redirect agent traffic from the real Automate server to the attacker's server. - The exploit flow is multi-stage: (1) The agent is tricked into downloading a malicious plugin, (2) the plugin exfiltrates credentials to the attacker's `/pwned` endpoint, (3) the attacker can then send arbitrary commands to the agent, including cleanup and persistence actions. - The default payload demonstrates code execution by running a ping command, but the infrastructure supports arbitrary command execution and further post-exploitation. The exploit is operational and demonstrates real-world attack capability, including credential theft and remote code execution. It requires the attacker to be in a network position to intercept or redirect agent traffic (e.g., via ARP spoofing, DNS poisoning, or local access). The repository is well-documented and modular, supporting further extension for other attack scenarios.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A prior ConnectWise Automate vulnerability involving lack of integrity checks when downloading code, referenced as similar background to CVE-2026-9089.
A high-severity vulnerability in ConnectWise Automate due to missing integrity checks in the update process, enabling attackers to inject malicious updates and execute unauthorized code on managed systems.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.