CVE-2021-35066

Summary: CVE-2021-35066 is an XXE vulnerability in ConnectWise Automate prior to 2021.0.6.132. The root cause is improper handling of XML external entities in the product’s processing, allowing an attacker to potentially access sensitive data or other impact as described by CVSS, with high-severi...

CVE-2020-15838

The CVE-2020-15838 affects the ConnectWise Automate Agent Update System. Before version 2020.8, Privilege Escalation is possible due to weak permissions on the _LTUPDATE folder. The vulnerability is rooted in improper access controls, enabling an attacker with network access to escalate privilege...

CVE-2020-15027

CVE-2020-15027 affects ConnectWise Automate up to 2020.x; it describes insufficient validation on certain authentication paths that can allow an authentication bypass via a series of attempts. The issue was addressed by a patch in 2020.7 and a hotfix for 2019.12. Connected documents corroborate t...

CVE-2026-9089

The CVE-2026-9089 issue affects the ConnectWise Automate Agent. According to connected sources, the agent does not fully verify the authenticity of components during plugin loading and self-update operations. The underlying impact is risk of tampered or unverified components being loaded during e...

CVE-2026-6066

The CVE-2026-6066 entry concerns ConnectWise Automate, specifically the Solution Center component. The vulnerability is described as client-to-server communications potentially occurring without transport-layer encryption, enabling network-based interception of Solution Center traffic in Automate...

CVE-2025-11492

CVE-2025-11492 concerns the ConnectWise Automate Agent where communications could default to HTTP instead of HTTPS, enabling a man‑in‑the‑middle attacker to intercept, modify, or replay agent–server traffic. The issue is tied to insecure transport, with mitigation in Automate 2025.9: all agent co...

CVE-2025-11493

The CVE-2025-11493 entry concerns the ConnectWise Automate Agent. The connected sources describe that the agent does not fully verify the authenticity of files downloaded from the server (updates, dependencies, and integrations), creating a risk of a man-in-the-middle substitution of legitimate f...