Priority MEDIUM 40
The ConnectWise Automate™ Agent does not fully verify the authenticity of components obtained during plugin loading and self-update operations.
CVSS 3.1HIGH 8.8· Adjacent network · No auth · No interaction · EPSS 0.00311 · Published 2026-05-21 · Fixed in 2026.5 CWE-494
Priority LOW 30
ConnectWise has released a security update for ConnectWise Automate™ that addresses a behavior in the ConnectWise Automate Solution Center where certain client-to-server communications could occur without transport-layer…
CVSS 3.1HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00082 · Published 2026-04-20 · Fixed in 2026.4 CWE-319
Priority LOW 39
The ConnectWise Automate Agent does not fully verify the authenticity of files downloaded from the server, such as updates, dependencies, and integrations.
CVSS 3.1HIGH 8.8· Adjacent network · No auth · No interaction · EPSS 0.00225 · Published 2025-10-16 · Fixed in 2025.9 CWE-494
Priority MEDIUM 42
In the ConnectWise Automate Agent, communications could be configured to use HTTP instead of HTTPS.
CVSS 3.1CRITICAL 9.6· Adjacent network · No auth · No interaction · EPSS 0.00203 · Published 2025-10-16 · Fixed in 2025.9 CWE-319
Priority LOW 39
ConnectWise ScreenConnect through 23.8.4 allows man-in-the-middle attackers to achieve remote code execution via crafted messages.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.01044 · Published 2024-02-01 · No fix listed CWE-94
Priority LOW 25
ConnectWise ScreenConnect through 23.8.4 allows local users to connect to arbitrary relay servers via implicit trust of proxy settings
CVSS 3.1MEDIUM 5.5· Local · Low privileges · No interaction · EPSS 0.00445 · Published 2024-02-01 · No fix listed CWE-287
Priority LOW 26
Connectwise Automate 2022.11 is vulnerable to Cleartext authentication.
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.0034 · Published 2023-02-01 · No fix listed CWE-319
Priority LOW 27
Connectwise Automate 2022.11 is vulnerable to Clickjacking.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00374 · Published 2023-02-01 · No fix listed CWE-1021
Priority MEDIUM 44
An XXE vulnerability exists in ConnectWise Automate before 2021.0.6.132.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01061 · Published 2021-06-21 · No fix listed CWE-611
Priority MEDIUM 41
The Agent Update System in ConnectWise Automate before 2020.8 allows Privilege Escalation because the _LTUPDATE folder has weak permissions.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01235 · Published 2020-10-09 · No fix listed CWE-732
Priority MEDIUM 45
ConnectWise Automate through 2020.x has insufficient validation on certain authentication paths, allowing authentication bypass via a series of attempts.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01343 · Published 2020-07-16 · No fix listed CWE-287
THREATIST.IORead the docs