ConnectWise Automate's Solution Center allowed unencrypted client-server traffic open to interception, fixed in 2026.4
Status: UPDATED
| Advisory ID: CVE-2026-6066
Key Details
| CVE | CVE-2026-6066 |
| CVSS Score / Version | 7.1 (High) / CVSS v3.1 |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N |
| CVSS Prose | attack vector is network; attack complexity is low; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is low; availability impact is none. |
| Affected products | ConnectWise automate |
| Classified as | CWE-319 (Cleartext Transmission of Sensitive Information) |
| Exploitation prediction (EPSS) | 0.08% probability of exploitation in the next 30 days (0% percentile) -- FIRST.org's EPSS model. |
Affected Products, Subsystems & Sectors
| Subsystems | General OT |
| Sectors | Multiple |
What to Know
ConnectWise has released a security update for ConnectWise Automate™ that addresses a behavior in the ConnectWise Automate Solution Center where certain client-to-server communications could occur without transport-layer encryption. This could allow network‑based interception of Solution Center traffic in Automate deployments. The issue has been resolved in Automate 2026.4 by enforcing secure communication for affected Solution Center connections.
What to Do
Monitor ConnectWise's web page for any future patch releases. See vendor advisory link below.
References