Status: UPDATED | Advisory ID: CVE-2026-6066
| CVE | CVE-2026-6066 |
| CVSS Score / Version | 7.1 (High) / CVSS v3.1 |
| Updated | 2026-09-24 |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N |
| CVSS Prose | attack vector is network; attack complexity is low; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is low; availability impact is none. |
| Affected products | ConnectWise automate |
| Classified as | CWE-319 (Cleartext Transmission of Sensitive Information) |
| Exploitation prediction (EPSS) | 0.08% probability of exploitation in the next 30 days (0% percentile) -- FIRST.org's EPSS model. |
| Vendor | Product | Affected Versions | Patch Status |
|---|---|---|---|
| ConnectWise | automate |
| Subsystems | General OT |
| Sectors | Multiple |
ConnectWise has released a security update for ConnectWise Automate™ that addresses a behavior in the ConnectWise Automate Solution Center where certain client-to-server communications could occur without transport-layer encryption. This could allow network‑based interception of Solution Center traffic in Automate deployments. The issue has been resolved in Automate 2026.4 by enforcing secure communication for affected Solution Center connections.
Monitor ConnectWise's web page for any future patch releases. See vendor advisory link below.