PatchTheCVECVE-2025-11492: In the ConnectWise Automate Agent, communications could be configured to use HTTP instead of HTTPS
CVE-2025-11492 is a critical-severity flaw (CVSS 9.6) affecting automate. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
In the ConnectWise Automate Agent, communications could be configured to use HTTP instead of HTTPS. In such cases, an on-path threat actor with a man-in-the-middle network position could intercept, modify, or replay agent-server traffic. Additionally, the encryption method used to obfuscate some communications over the HTTP channel is updated in the Automate 2025.9 patch to enforce HTTPS for all agent communications.
Why this priority
- Critical severity
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.6 (Critical) |
| Attack vector | Adjacent network |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.2% (top 90%) |
| CISA exploited list | No |
| Weakness | CWE-319 |
| Published | 2025-10-16 |
| Last modified | 2026-10-09 |
Last updated 2026-10-09 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2025-11492?
automate: upgrade to 2025.9. Exact commands for each OS are on this page.
Is CVE-2025-11492 being exploited?
CVE-2025-11492 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2025-11492 affect?
CVE-2025-11492 affects automate. Severity is critical (CVSS 9.6). In the ConnectWise Automate Agent, communications could be configured to use HTTP instead of HTTPS. In such cases, an on-path threat actor with a man-in-the-middle network position could intercept, modify, or replay agent-server traffic. Ad
How urgent is CVE-2025-11492?
Priority 36/100. Critical severity
Software pages
ConnectWise ScreenConnect vulnerabilities
Related CVEs
- CVE-2026-6066 HIGH 7.1 UPGRADE ConnectWise has released a security update for ConnectWise Automate™ that addresses a behavior in the ConnectW
- CVE-2025-11493 HIGH 8.8 UPGRADE The ConnectWise Automate Agent does not fully verify the authenticity of files downloaded from the server, suc
- CVE-2025-8868 CRITICAL 9.8 UPGRADE In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker ca
- CVE-2025-6724 HIGH 8.8 UPGRADE In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker ca
- CVE-2026-9089 HIGH 8.8 UPGRADE The ConnectWise Automate™ Agent does not fully verify the authenticity of components obtained during plugin lo