Man-in-the-Middle Vulnerability in ConnectWise Automate Agent

CVE-2025-11493

What is CVE-2025-11493?

The ConnectWise Automate Agent exhibits a vulnerability where it lacks proper validation of files downloaded from its server, including updates and dependencies. This deficiency allows an attacker on the network path to execute a man-in-the-middle attack, potentially substituting dangerous files for legitimate ones by masquerading as the trusted server. To mitigate this security concern, enforcing HTTPS is recommended along with addressing related vulnerabilities.

References