ConnectWise Automate 2025.9 Security Fix
10/16/2025
Products: ConnectWise Automate
Severity: Important
Priority: 2 - Moderate
Summary
ConnectWise has released a security update for ConnectWise Automate™ addressing vulnerabilities that could expose agent communications and updates to interception or tampering if certain configurations are used. In on-prem environments, agents could be configured to use HTTP or rely on encryption, that could allow a network-based adversary to view or modify traffic or substitute malicious updates. Automate 2025.9 patch enforces HTTPS for all agent communications to mitigate these risks. Partners running on-prem servers should also ensure TLS 1.2 is enforced to maintain secure communications.
Vulnerability
| CVE | CWE ID | Description | Base Score | Vector | |
|---|---|---|---|---|---|
| CVE-2025-11492 | CWE-319 | Cleartext Transmission of Sensitive Information | 9.6 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H | |
| CVE-2025-11493 | CWE-494 | Download of Code Without Integrity Check | 8.8 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Severity
Important — Vulnerabilities that could compromise confidential data or other resources but require additional access, privilege or circumstances to do so.
Priority
2 – Moderate — Vulnerabilities that are either being targeted or have higher risk of being targeted by exploits in the wild. Recommend installing updates as emergency changes or as soon as possible (e.g. within days).
Affected Versions
ConnectWise Automate versions prior to 2025.9
Remediation
Cloud: Cloud instances have already been updated to the latest Automate release.
On-prem: Apply the 2025.9 release.
For instruction on updating to the newest release, please reference this doc: ConnectWise Automate Release Notes 2025.9 - ConnectWise