| Package | Affected versions | Patched versions |
|---|---|---|
| automate | < 2025.9 | 2025.9 |
The ConnectWise Automate Agent does not fully verify the authenticity of files downloaded from the server, such as updates, dependencies, and integrations. This creates a risk where an on-path attacker could perform a man-in-the-middle attack and substitute malicious files for legitimate ones by impersonating a legitimate server. This risk is mitigated when HTTPS is enforced and is related to CVE-2025-11492.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free