Man-in-the-Middle Vulnerability in ConnectWise Automate Agent

CVE-2025-11492

What is CVE-2025-11492?

The ConnectWise Automate Agent is susceptible to a vulnerability where communications can be configured to use unsecure HTTP instead of secure HTTPS. This flaw could be exploited by an attacker positioned within the network to intercept, modify, or replay sensitive agent-server communications. It is crucial for users to update to the Automate 2025.9 patch, which mandates the use of HTTPS for all agent communications, thereby enhancing security and protecting against potential exploitation.

References