Introduction
Managed service providers who rely on ConnectWise Automate to orchestrate thousands of endpoints now face a new integrity verification gap in the agent's plugin loading and self-update mechanisms. CVE-2026-9089, disclosed on May 21, 2026, carries a CVSS score of 8.8. It could allow an attacker on an adjacent network to substitute malicious components without any privileges or user interaction.
ConnectWise Automate is a remote monitoring and management (RMM) platform built for enterprise-scale managed service providers that run endpoints across complex organizational structures. It has deep scripting and automation capabilities and is a central tool in the MSP market. The Automate agent runs with high privileges across large endpoint fleets, so a flaw in its update or loading pipeline has a large blast radius.
Technical Information
CVE-2026-9089 falls under CWE-494: Download of Code Without Integrity Check. The ConnectWise Automate Agent does not fully verify the authenticity of components it obtains during two operations: plugin loading and self-update. Under certain conditions, the agent may process these components without full integrity verification before loading them.
CVSS Vector Breakdown
The full CVSS 3.1 vector is CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which breaks down as follows:
| Metric | Value | Implication |
|---|---|---|
| Attack Vector | Adjacent (AV:A) | Attacker must be on the local network or a shared physical/logical network segment |
| Attack Complexity | Low (AC:L) | No special conditions or race conditions required |
| Privileges Required | None (PR:N) | No authentication needed |
| User Interaction | None (UI:N) | No victim action required |
| Scope | Unchanged (S:U) | Impact is confined to the vulnerable component's security scope |
| Confidentiality | High (C:H) | Full read access to the compromised endpoint |
| Integrity | High (I:H) | Full write access, including code execution |
| Availability | High (A:H) | Complete disruption of the endpoint is possible |
Attack Flow
Based on the architectural behavior described in the public security bulletin, exploitation follows this general sequence:
-
The attacker gets onto the same network segment as a target endpoint running the ConnectWise Automate Agent. This could be a shared LAN, a VLAN, or another adjacent network topology.
-
The Automate Agent starts a plugin loading or self-update operation and retrieves components (plugins or update binaries) from a source.
-
Because the agent does not fully verify the authenticity of these components, the attacker can intercept them or replace them with malicious payloads. From the adjacent position, the attacker can use ARP spoofing or other local network manipulation to redirect or tamper with component delivery.
-
The agent loads the substituted component without detecting the tampering, and the attacker gets code execution with the privileges of the Automate Agent process.
-
RMM agents typically run with high privileges, so successful exploitation yields full compromise of the endpoint: complete access to data (confidentiality), the ability to modify system state (integrity), and the ability to disrupt operations (availability).
Limitations of Current Analysis
Public disclosures do not include specific proof-of-concept exploits, detailed indicators of compromise, or the exact file paths affected by this vulnerability. Detailed remediation instructions and release notes sit behind a vendor single sign-on portal. Our analysis is therefore limited to the architectural behavior described in the public security bulletin.
Affected Systems and Versions
All versions of ConnectWise Automate prior to version 2026.5 are affected. The fix is included in the Automate 2026.5 release.
| Deployment Type | Status | Action Required |
|---|---|---|
| Cloud Instances | Already updated to Automate 2026.5 | Verify version. No manual action needed |
| On-Premises Instances | Vulnerable if running any version prior to 2026.5 | Apply the 2026.5 release within 30 days of the bulletin |
ConnectWise rates this vulnerability "Important" in severity, with a "Priority 2 Moderate" status. That status means the risk is elevated, but exploits are neither known nor anticipated to be imminent.
Defense-in-Depth Recommendations
The current bulletin does not detail specific workarounds for CVE-2026-9089. A similar earlier Automate vulnerability, CVE-2025-11493, also involved a lack of integrity checks when downloading code. For that one, ConnectWise advised partners running on-premises servers to enforce HTTPS for all agent communications and to enforce TLS 1.2, keeping communications secure and mitigating interception attacks. Organizations should keep these transport layer protections active as a complementary defense.
Vendor Security History
ConnectWise has addressed several high-severity issues across its product suite in recent months, and cryptographic and integrity verification failures keep coming up:
| Date | Product | CVE | Summary |
|---|---|---|---|
| 2025 | Automate 2025.9 | CVE-2025-11493 | Lack of integrity checks when downloading code, allowing potential interception attacks |
| March 17, 2026 | ScreenConnect 26.1 | CVE-2026-3564 | Issues related to how server-level cryptographic material is protected |
| May 21, 2026 | Automate 2026.5 | CVE-2026-9089 | Agent does not fully verify the authenticity of components during plugin loading and self update |
CWE-494 has now appeared twice in the Automate product line, in CVE-2025-11493 and CVE-2026-9089. That suggests an architectural pattern in how the agent retrieves and validates components, one that has needed more than one round of remediation. Organizations running ConnectWise products on premises should factor this history into their patch prioritization and consider whether agent update traffic warrants additional network segmentation or monitoring.
Current Threat Landscape
As of publication, there is no evidence of active exploitation. ConnectWise explicitly states that exploits are neither known nor anticipated to be imminent. CISA added seven new vulnerabilities to its Known Exploited Vulnerabilities Catalog on May 20, 2026, and CVE-2026-9089 is not among them. Current intelligence supports treating this as a high-priority patch cycle, not an active incident response. Organizations should keep monitoring threat feeds for any change to this assessment.
References
- ConnectWise Automate 2026.5 Security Bulletin
- NVD Entry for CVE-2026-9089
- NVD Entry for CVE-2025-11493
- SecurityWeek: ConnectWise Patches Critical Flaw in Automate RMM Tool
- ConnectWise Security Bulletins Index
- ConnectWise ScreenConnect 26.1 Security Bulletin
- CISA: Adds Seven Known Exploited Vulnerabilities to Catalog (May 20, 2026)
