Connectwise Automate
11 CVEs affecting Connectwise Automate. Latest disclosed: 2026-05-21. Critical: 3, High: 5.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-35066 | Critical | 9.8 | 2021-06-21 | An XXE vulnerability exists in ConnectWise Automate before 2021.0.6.132. |
CVE-2020-15027 | Critical | 9.8 | 2020-07-16 | ConnectWise Automate through 2020.x has insufficient validation on certain authentication paths, allowing authentication bypass via a series of attempts. This… |
CVE-2025-11492 | Critical | 9.6 | 2025-10-16 | In the ConnectWise Automate Agent, communications could be configured to use HTTP instead of HTTPS. In such cases, an on-path threat actor with a man-in-the-mi… |
CVE-2026-9089 | High | 8.8 | 2026-05-21 | The ConnectWise Automate™ Agent does not fully verify the authenticity of components obtained during plugin loading and self-update operations. This issue is a… |
CVE-2025-11493 | High | 8.8 | 2025-10-16 | The ConnectWise Automate Agent does not fully verify the authenticity of files downloaded from the server, such as updates, dependencies, and integrations. Thi… |
CVE-2020-15838 | High | 8.8 | 2020-10-09 | The Agent Update System in ConnectWise Automate before 2020.8 allows Privilege Escalation because the _LTUPDATE folder has weak permissions. |
CVE-2023-47257 | High | 8.1 | 2024-02-01 | ConnectWise ScreenConnect through 23.8.4 allows man-in-the-middle attackers to achieve remote code execution via crafted messages. |
CVE-2026-6066 | High | 7.1 | 2026-04-20 | ConnectWise has released a security update for ConnectWise Automate™ that addresses a behavior in the ConnectWise Automate Solution Center where certain client… |
CVE-2023-23126 | Medium | 6.1 | 2023-02-01 | Connectwise Automate 2022.11 is vulnerable to Clickjacking. The login screen can be iframed and used to manipulate users to perform unintended actions. NOTE: t… |
CVE-2023-23130 | Medium | 5.9 | 2023-02-01 | Connectwise Automate 2022.11 is vulnerable to Cleartext authentication. Authentication is being done via HTTP (cleartext) with SSL disabled. OTE: the vendor's… |
CVE-2023-47256 | Medium | 5.5 | 2024-02-01 | ConnectWise ScreenConnect through 23.8.4 allows local users to connect to arbitrary relay servers via implicit trust of proxy settings |