CVE-2023-23126

6.1 mediumEPSS 0.4%

Medium (6.1) in connectwise automate. EPSS 0.4% chance of exploitation in the next 30 days.

Connectwise Automate 2022.11 is vulnerable to Clickjacking. The login screen can be iframed and used to manipulate users to perform unintended actions. NOTE: the vendor's position is that a Content-Security-Policy HTTP response header is present to block this attack.

Severity

CVSS 3.1

6.1 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 31% of CVEs (scores of 2026-10-31)
CWE: CWE-1021
Published: 2023-02-01
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

connectwise:automate

References

https://github.com/l00neyhacker/CVE-2023-23126
https://github.com/l00neyhacker/CVE-2023-23126

Check your stack JSON