CVE-2025-11492

In the ConnectWise Automate Agent, communications could be configured to use HTTP instead of HTTPS. In such cases, an on-path threat actor with a man-in-the-middle network position could intercept, modify, or replay agent-server traffic. Additionally, the encryption method used to obfuscate some communications over the HTTP channel is updated in the Automate 2025.9 patch to enforce HTTPS for all agent communications.

CVSS 3.1

7.5CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.2% chance of exploitation in the next 30 days; higher than 10% of CVEs (scores of 2026-10-25)

CWE

CWE-319

Published

2025-10-16

Modified

2026-10-09

Record from

the NVD, synced 2026-10-19

Affected

• connectwise:automate

References

• https://www.connectwise.com/company/trust/security-bulletins/connectwise-automate-2025.9-security-fix

Check your stackJSON