HTTP Configuration and Encryption in Transit
Priority MEDIUM 42CWE-319Published · Updated
Key facts
- Attack vector
- Adjacent network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-319.
Summary
In the ConnectWise Automate Agent, communications could be configured to use HTTP instead of HTTPS. In such cases, an on-path threat actor with a man-in-the-middle network position could intercept, modify, or replay agent-server traffic. Additionally, the encryption method used to obfuscate some communications over the HTTP channel is updated in the Automate 2025.9 patch to enforce HTTPS for all agent communications.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00203 10th percentileScored 2026-11-07
Fix Fixed Automate (ConnectWise): 2025.9
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ConnectWise | Automate | before 2025.9 | 2025.9 | Patch available | CNA |
- Automate VendorConnectWise Affected before 2025.9 Fixed in 2025.9 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:connectwise:automate:*:*:*:*:*:*:*:* | before 2025.9 | Vulnerable | ConnectWise |
- cpe:2.3:a:connectwise:automate:*:*:*:*:*:*:*:* Versions before 2025.9 Vulnerable ·ConnectWise
Remediation
- Fix · CNA Automate (ConnectWise) Fixed in 2025.9
Timeline
- 2026-10-02 Threatist record created from CVE-2025-11492
- 2026-10-03 Alias added: GHSA-4676-8cx2-xvgq
References
More ConnectWise Automate vulnerabilities
- TI-2020-11814 ConnectWise Automate through 2020.x has insufficient validation on certain authentication… CVSS 3.1CRITICAL 9.8
- TI-2021-14026 An XXE vulnerability exists in ConnectWise Automate before 2021.0.6.132. CVSS 3.1CRITICAL 9.8
- TI-2020-12466 The Agent Update System in ConnectWise Automate before 2020.8 allows Privilege Escalation… CVSS 3.1HIGH 8.8
- TI-2026-07986 The ConnectWise Automate™ Agent does not fully verify the authenticity of components… CVSS 3.1HIGH 8.8
- TI-2025-10529 Self-Update Verification Mechanism Process in ConnectWise Automate CVSS 3.1HIGH 8.8
- TI-2023-25574 ConnectWise ScreenConnect through 23.8.4 allows man-in-the-middle attackers to achieve… CVSS 3.1HIGH 8.1
Sources
- CVE-2025-11492 · CVE Program
- CVE-2025-11492 · NVD
- FIRST EPSS
- GHSA-4676-8cx2-xvgq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences