ConnectWise Flaws Let Attackers Deliver Malicious Software Updates

According to GBHackers On Security, ConnectWise has issued a critical security update for its Automate platform after uncovering vulnerabilities that could allow attackers to intercept and tamper with software updates. ConnectWise Automate 2025.9, released on 16 October 2025, enforces HTTPS for all agent communications to close the window for plain‑text interception.

The flaws arise in on‑premises installations configured to use unsecured communication channels, with two CVEs identified: CVE-2025-11492 (cleartext transmission) and CVE-2025-11493 (download of code without integrity check), both rated highly in CVSS terms. Attackers could inject malicious payloads into the update process, leading to unauthorised code being installed on compromised agents.

The guidance calls for on‑premises deployments to reject HTTP and enforce TLS 1.2 or newer, while cloud‑hosted instances have already received the update. Administrators running affected versions should apply the 2025.9 release promptly and verify that agent traffic is transmitted via HTTPS with TLS 1.2 or higher.