CVE-2026-6066CWE-319

Unencrypted Client‑Server Communication in ConnectWise Automate™ Solution Center

High · published April 20, 2026

CVSS v3.1
7.1
EPSS
0%
Percentile
2.2
In the wild
Unconfirmed
What it is

ConnectWise has released a security update for ConnectWise Automate™ that addresses a behavior in the ConnectWise Automate Solution Center where certain client-to-server communications could occur without transport-layer encryption. This could allow network‑based interception of Solution Center traffic in Automate deployments. The issue has been resolved in Automate 2026.4 by enforcing secure communication for affected Solution Center connections.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00127 · 2.2th percentile
Weakness
CWE-319 · Cleartext Transmission of Sensitive Information
Published
2026-04-20T15:26Z
EPSS history
Timeline
  • 20 APR 15:26Z
    Unencrypted Client‑Server Communication in ConnectWise Automate™ Solution Center
    cvelistv5