CVE-2026-9089

⚠️ high

Summary

The ConnectWise Automate™ Agent does not fully verify the authenticity of components obtained during plugin loading and self-update operations. This issue is addressed in Automate 2026.5.

CVSS Score

8.8

High

EPSS Score

0.3

Exploit Probability

Published Date

2026-05-21

First Seen: 2026-05-22

📊 Relative Risk Intelligence

This CVE is High Risk - more severe than 80.8% of all 353,401 vulnerabilities in our database.

#67,844

Top 25% most severe

Severity Percentile

🎯 CISA SSVC Assessment Updated: May 21, 2026

🔍 Exploitation Status

None

No known exploits

⚙️ Automatable

Requires human interaction

💥 Technical Impact

Total

Complete system compromise possible

SSVC data provided by CISA

Last Modified 2026-07-23

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE IDs (Weakness Types)

CWE-494

📦 Affected Products 1

Vendor	Product	Status	Affected Versions
connectwise	automate	Affected	< 2026.5

🔗 References 1

https://www.connectwise.com/company/trust/security-b...

Vendor Advisory

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2025-11492	⛔ critical	9.6	0.0	In the ConnectWise Automate Agent, communications could be configured to use HTTP instead of HTTPS. In such cases, an on...	2025-10-16
CVE-2025-11493	⚠️ high	8.8	0.0	The ConnectWise Automate Agent does not fully verify the authenticity of files downloaded from the server, such as updat...	2025-10-16
CVE-2023-47256	🔶 medium	5.5	0.1	ConnectWise ScreenConnect through 23.8.4 allows local users to connect to arbitrary relay servers via implicit trust of ...	2024-02-01
CVE-2023-47257	⚠️ high	8.1	5.0	ConnectWise ScreenConnect through 23.8.4 allows man-in-the-middle attackers to achieve remote code execution via crafted...	2024-02-01
CVE-2023-23126	🔶 medium	6.1	0.3	Connectwise Automate 2022.11 is vulnerable to Clickjacking. The login screen can be iframed and used to manipulate users...	2023-02-01
CVE-2023-23130	🔶 medium	5.9	0.2	Connectwise Automate 2022.11 is vulnerable to Cleartext authentication. Authentication is being done via HTTP (cleartext...	2023-02-01

These CVEs affect the same products