CVE-2025-11493 - CVE House
Back to Database
Status published High CVE-2025-11493

Self-Update Verification Mechanism Process in ConnectWise Automate

Vulnerability Description

The ConnectWise Automate Agent does not fully verify the authenticity of files downloaded from the server, such as updates, dependencies, and integrations. This creates a risk where an on-path attacker could perform a man-in-the-middle attack and substitute malicious files for legitimate ones by impersonating a legitimate server. This risk is mitigated when HTTPS is enforced and is related to CVE-2025-11492.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-11493

Credits & Attribution

No credits recorded in the NVD database.

References

More from ConnectWise

View All →
CVE-2025-7204
Exposure of password hashes via API responses in ConnectWise PSA
Medium 6.5
CVE-2025-4876
Hardcoded Key Revealed in ConnectWise Password Encryption Utility
Medium 6
CVE-2025-3935
ScreenConnect Exposure to ASP.NET ViewState Code Injection
High 8.1
CVE-2025-14823
Certificate Signing Extension Returns Encrypted Values
Medium 5.3
CVE-2025-14265
Improper server-side validation in ScreenConnect extension framework
Critical 9.1

Affected Vendor

ConnectWise

View all reports →

Affected Software

Automate
Vulnerable Versions:
All versions prior to 2025.9

Timeline

Official Publish: October 16th, 2025
Last Modified: February 26th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-494

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.