VulnerabilityAnalyzed

CVE-2026-6066

This could allow network‑based interception of Solution Center traffic in Automate deployments.

HIGH 7.1EPSS 0.08%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.08%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

ConnectWise has released a security update for ConnectWise Automate™ that addresses a behavior in the ConnectWise Automate Solution Center where certain client-to-server communications could occur without transport-layer encryption. This could allow network‑based interception of Solution Center traffic in Automate deployments. The issue has been resolved in Automate 2026.4 by enforcing secure communication for affected Solution Center connections.

CVSS 3.1: 7.1 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
EPSS: 0.08% probability · 0th percentile
CISA KEV: Not listed
Weakness: CWE-319
Affected: connectwise/automate
Source: 7d616e1a-3288-43b1-a0dd-0a65d3e70a49

References

https://www.connectwise.com/company/trust/security-bulletins/2026-04-20-connectwise-automate-bulletinVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.