Authentication Weakness in ConnectWise Automate Agent

CVE-2026-9089

What is CVE-2026-9089?

The ConnectWise Automate Agent has a vulnerability that allows it to operate without fully verifying the authenticity of components during plugin loading and self-update processes. This lack of validation poses significant security risks, as malicious components could potentially be loaded without detection. The issue has been addressed in the Automate version 2026.5, emphasizing the importance of keeping software updated to mitigate potential exploits.

References