Connectwise
Connectwise Automate: vulnerabilidades y CVE
Connectwise Automate tiene 11 vulnerabilidades publicadas, 4 de ellas en los últimos 12 meses. 2 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE11
Últimos 12 meses4
Críticas2
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-9089 | Alta (8.8) | 0.21% | — | 21 may 2026 | The ConnectWise Automate™ Agent does not fully verify the authenticity of components obtained during plugin loading and self-update operations. This issue is addressed in Automate 2026.5. |
| CVE-2026-6066 | Alta (7.1) | 0.13% | — | 20 abr 2026 | ConnectWise has released a security update for ConnectWise Automate™ that addresses a behavior in the ConnectWise Automate Solution Center where certain client-to-server communications could occur without… |
| CVE-2025-11493 | Alta (7.5) | 0.23% | — | 16 oct 2025 | The ConnectWise Automate Agent does not fully verify the authenticity of files downloaded from the server, such as updates, dependencies, and integrations. This creates a risk where an on-path attacker could perform a… |
| CVE-2025-11492 | Alta (7.5) | 0.21% | — | 16 oct 2025 | In the ConnectWise Automate Agent, communications could be configured to use HTTP instead of HTTPS. In such cases, an on-path threat actor with a man-in-the-middle network position could intercept, modify, or replay… |
| CVE-2023-47257 | Alta (8.1) | 1.0% | — | 1 feb 2024 | ConnectWise ScreenConnect through 23.8.4 allows man-in-the-middle attackers to achieve remote code execution via crafted messages. |
| CVE-2023-47256 | Media (5.5) | 0.45% | — | 1 feb 2024 | ConnectWise ScreenConnect through 23.8.4 allows local users to connect to arbitrary relay servers via implicit trust of proxy settings |
| CVE-2023-23130 | Media (5.9) | 0.34% | — | 1 feb 2023 | Connectwise Automate 2022.11 is vulnerable to Cleartext authentication. Authentication is being done via HTTP (cleartext) with SSL disabled. OTE: the vendor's position is that, by design, this is controlled by a… |
| CVE-2023-23126 | Media (6.1) | 0.37% | — | 1 feb 2023 | Connectwise Automate 2022.11 is vulnerable to Clickjacking. The login screen can be iframed and used to manipulate users to perform unintended actions. NOTE: the vendor's position is that a Content-Security-Policy HTTP… |
| CVE-2021-35066 | Crítica (9.8) | 1.1% | — | 21 jun 2021 | An XXE vulnerability exists in ConnectWise Automate before 2021.0.6.132. |
| CVE-2020-15838 | Alta (8.8) | 1.2% | — | 9 oct 2020 | The Agent Update System in ConnectWise Automate before 2020.8 allows Privilege Escalation because the _LTUPDATE folder has weak permissions. |
| CVE-2020-15027 | Crítica (9.8) | 1.3% | — | 16 jul 2020 | ConnectWise Automate through 2020.x has insufficient validation on certain authentication paths, allowing authentication bypass via a series of attempts. This was patched in 2020.7 and in a hotfix for 2019.12. |