Critical ConnectWise Automate Flaw (CVE-2025-11492, CVSS 9.6) Allows RMM Agent Man-in-the-Middle Attack

ConnectWise has issued a critical patch for its Automate remote monitoring and management platform addressing two high-severity flaws, CVE-2025-11492 (CVSS 9.6) and CVE-2025-11493 (CVSS 8.8), affecting Automate versions prior to 2025.9.

The first flaw stems from a configuration issue where Automate Agents could be set to communicate via unencrypted HTTP rather than HTTPS, enabling an on-path attacker with a man-in-the-middle position to intercept, modify, or replay traffic between agents and servers, according to CVE[.]org.

The second flaw involves insufficient verification of update files downloaded by the Automate Agent, creating a risk that an on-path attacker could substitute malicious files for legitimate ones by impersonating a server, potentially delivering malware through the RMM’s update mechanism. ConnectWise states that cloud-hosted instances have already been updated to the latest Automate release, while on-premises deployments must apply the 2025.9 release to address both vulnerabilities.

The patch enforces HTTPS for all agent communications and recommends ensuring TLS 1.2 is enforced to maintain secure communications. Both flaws are related and mitigated by the HTTPS enforcement between agents and servers, according to the vendor.