Every CVE whose affected-product data names Connectwise Automate, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.
CVEs (11)
CVE-2020-15027 — CVSS 9.8 (critical): ConnectWise Automate through 2020.x has insufficient validation on certain authentication paths, allowing authentication bypass via a…
CVE-2025-11492 — CVSS 9.6 (critical): In the ConnectWise Automate Agent, communications could be configured to use HTTP instead of HTTPS. In such cases, an on-path threat actor…
CVE-2026-9089 — CVSS 8.8 (high): The ConnectWise Automate™ Agent does not fully verify the authenticity of components obtained during plugin loading and self-update…
CVE-2020-15838 — CVSS 8.8 (high): The Agent Update System in ConnectWise Automate before 2020.8 allows Privilege Escalation because the _LTUPDATE folder has weak permissions.
CVE-2025-11493 — CVSS 8.8 (high): The ConnectWise Automate Agent does not fully verify the authenticity of files downloaded from the server, such as updates, dependencies…
CVE-2023-47257 — CVSS 8.1 (high): ConnectWise ScreenConnect through 23.8.4 allows man-in-the-middle attackers to achieve remote code execution via crafted messages.
CVE-2026-6066 — CVSS 7.1 (high): ConnectWise has released a security update for ConnectWise Automate™ that addresses a behavior in the ConnectWise Automate Solution…
CVE-2023-23126 — CVSS 6.1 (medium): Connectwise Automate 2022.11 is vulnerable to Clickjacking. The login screen can be iframed and used to manipulate users to perform…
CVE-2023-23130 — CVSS 5.9 (medium): Connectwise Automate 2022.11 is vulnerable to Cleartext authentication. Authentication is being done via HTTP (cleartext) with SSL…
CVE-2023-47256 — CVSS 5.5 (medium): ConnectWise ScreenConnect through 23.8.4 allows local users to connect to arbitrary relay servers via implicit trust of proxy settings