Loading vulnerability…
ConnectWise Automate Agent plugin loading and self-update integrity verification flaw
CVE-2026-9089 is a vulnerability in the ConnectWise Automate Agent affecting plugin loading and self-update operations. The agent does not fully verify the authenticity and integrity of components obtained during these workflows before processing and loading them. This creates a download-of-code-without-integrity-check condition in which a maliciously substituted component can be accepted and executed by the agent. The issue affects ConnectWise Automate versions prior to 2026.5 and is addressed in version 2026.5 through enhanced integrity verification for agent components.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can allow an attacker to substitute a malicious component during plugin loading or agent self-update and have it executed by the ConnectWise Automate Agent. Because the agent may run with elevated privileges, exploitation can result in unauthorized code execution on the affected endpoint with high impact to confidentiality, integrity, and availability. In managed service provider environments, compromise of Automate-managed systems could also facilitate persistence, lateral movement, and broader downstream compromise across managed client fleets.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by limiting opportunities for adjacent-network traffic interception or manipulation between agents and update/plugin delivery paths. Enforce protected transport for agent communications, including HTTPS and TLS 1.2 where supported, and segment or harden local network environments to make on-path attacks more difficult. Monitor for anomalous plugin activity and unexpected agent update behavior until the fixed release is deployed. These measures are compensating controls and do not replace upgrading to 2026.5 or later.
Patch, then assume compromise.
Upgrade ConnectWise Automate to version 2026.5 or later, which introduces enhanced integrity verification for all agent components and addresses CVE-2026-9089. Cloud-hosted instances have already been updated by the vendor. On-premises deployments running versions prior to 2026.5 should be patched as a priority within the vendor-recommended 30-day remediation window.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.