PT-2025-42524 · Connectwise · Connectwise Automate Agent

Published 2025-10-16 · Updated 2025-10-29 · CVE-2025-11493

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ConnectWise Automate Agent (affected versions not specified)

Description The software does not fully validate the authenticity of downloaded files, including updates, dependencies, and integrations. This allows a man-in-the-middle attacker to substitute malicious files for legitimate ones by impersonating a legitimate server. The risk is present when HTTPS is not enforced.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-494

Related Identifiers

CVE-2025-11493

Affected Products

Connectwise Automate Agent

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2025-11493 · Security Note
• https://osv.dev/vulnerability/CVE-2025-11493 · Vendor Advisory
• https://connectwise.com/company/trust/security-bulletins/connectwise-automate-2025.9-security-fix · Vendor Advisory
• https://t.me/cveNotify/140880 · Telegram Post
• https://twitter.com/CVEnew/status/1978926544111243356 · Twitter Post
• https://reddit.com/r/pwnhub/comments/1obj1z0/connectwise_addresses_serious_security_flaws_in · Reddit Post
• https://twitter.com/zoomeye_team/status/1979022023528714331 · Twitter Post
• https://twitter.com/CveTodo/status/1978906321463250987 · Twitter Post
• https://t.me/CVEtracker/35137 · Telegram Post
• https://twitter.com/CCBalert/status/1980707153519247839 · Twitter Post
• https://twitter.com/socradar/status/1980223720213127463 · Twitter Post
• https://reddit.com/r/pwnhub/comments/1obj43a/connectwise_fixes_critical_flaw_in_automate_tool · Reddit Post