PT-2026-42478 · Connectwise · Automate Agent

Published 2026-05-21 · Updated 2026-05-27 · CVE-2026-9089

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ConnectWise Automate versions prior to 2026.5

Description The ConnectWise Automate Agent fails to fully verify the authenticity of components obtained during plugin loading and self-update operations. This lack of integrity checks during the download of code could allow for remote code execution.

Recommendations Update to version 2026.5.

Fix

RCE

Weakness Enumeration

CWE-494

Related Identifiers

CVE-2026-9089

Affected Products

Automate Agent

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2026-9089 · Security Note
• https://connectwise.com/company/trust/security-bulletins/2026-05-21-connectwise-automate-bulletin · Note
• https://twitter.com/seaarepea/status/2059748710284685713 · Twitter Post
• https://twitter.com/threatcluster/status/2059235814790373425 · Twitter Post
• https://twitter.com/threadlinqs/status/2059233340461293613 · Twitter Post
• https://twitter.com/UndercodeNews/status/2059245810336797037 · Twitter Post
• https://t.me/CSIRT_italia/3539 · Telegram Post
• https://t.me/CVEtracker/54530 · Telegram Post
• https://reddit.com/r/pwnhub/comments/1tkvhoy/critical_risk_identified_in_connectwise_automate · Reddit Post
• https://twitter.com/PurpleOps_io/status/2058777126526914752 · Twitter Post
• https://t.me/cveNotify/164621 · Telegram Post
• https://twitter.com/ADKCyber/status/2057832108937380154 · Twitter Post
• https://twitter.com/the_yellow_fall/status/2058455307689582787 · Twitter Post
• https://twitter.com/DFIR_Lab/status/2057626809793990734 · Twitter Post