ConnectWise Automate Plugin Integrity Verification Vulnerability

A vulnerability exists in ConnectWise Automate Agent versions prior to 2026.5, where the agent does not fully verify the authenticity of components during plugin loading and self-update processes. This lack of proper integrity checks can lead to the execution of unverified code, potentially allowing for malicious modifications or actions.

Impact

Exploitation of this vulnerability could result in the unauthorized execution of unverified code, with the potential for malicious components to be loaded and executed by the ConnectWise Automate Agent.

Remediation

Users can update to ConnectWise Automate version 2026.5, which includes improved integrity verification for all agent components. Instructions for updating to this release are available in the ConnectWise Automate Release Notes 2026.5.