Critical · published October 16, 2025
🚨 An on-path attacker can intercept your messages without a hitch due to a configuration that allows HTTP where HTTPS belongs! 🔥 Think of it like sending a postcard instead of a sealed letter; anyone can read and tamper with your message along the way. Switching to HTTPS is like using a locked mailbox that only you can access. An attacker positioned between your agent and server could easily eavesdrop, alter, or replay sensitive communications, putting your entire system at risk. The potential fallout? Data breaches, unauthorized access, and a whole lot of chaos that could leave your operations vulnerable!
Think of it like sending a postcard instead of a sealed letter; anyone can read and tamper with your message along the way. Switching to HTTPS is like using a locked mailbox that only you can access. In the ConnectWise Automate Agent, misconfigured communication allows for HTTP use instead of the secure HTTPS, enabling man-in-the-middle attacks that compromise data integrity and confidentiality.
An attacker positioned between your agent and server could easily eavesdrop, alter, or replay sensitive communications, putting your entire system at risk. The potential fallout? Data breaches, unauthorized access, and a whole lot of chaos that could leave your operations vulnerable! Update your ConnectWise Automate Agent to version 2025.9 or later to enforce HTTPS for all communications. Additionally, review your network configurations to ensure that HTTP is disabled and HTTPS is strictly enforced across all channels. You've got this! By patching up and securing your communications, you'll keep those pesky attackers at bay! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| connectwise/automate | < 2025.9 | 2025.9 |