CVE-2025-11493 | BDVDB-2026-298337 Detail

Description#

The ConnectWise Automate Agent does not fully verify the authenticity of files downloaded from the server, such as updates, dependencies, and integrations. This creates a risk where an on-path attacker could perform a man-in-the-middle attack and substitute malicious files for legitimate ones by impersonating a legitimate server. This risk is mitigated when HTTPS is enforced and is related to CVE-2025-11492.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12025-10-16Record published in the CVE List.
2. Version 22026-02-26Most recent update recorded in the CVE List.