CVE-2026-6066: ConnectWise Automate Info Disclosure Flaw

CVE-2026-6066 Overview

ConnectWise has released a security update for ConnectWise Automate™ that addresses a behavior in the ConnectWise Automate Solution Center where certain client-to-server communications could occur without transport-layer encryption. This cleartext transmission vulnerability (CWE-319) could allow network-based interception of Solution Center traffic in Automate deployments, potentially exposing sensitive data transmitted between clients and servers.

Critical Impact

Attackers positioned on the network could intercept unencrypted Solution Center communications, potentially capturing sensitive configuration data, credentials, or other confidential information transmitted between ConnectWise Automate clients and servers.

Affected Products

• ConnectWise Automate (all versions prior to 2026.4)
• ConnectWise Automate Solution Center component

Discovery Timeline

• 2026-04-20 - CVE-2026-6066 published to NVD
• 2026-04-20 - ConnectWise releases security patch in Automate 2026.4
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2026-6066

Vulnerability Analysis

This vulnerability stems from the ConnectWise Automate Solution Center component failing to enforce transport-layer encryption for certain client-to-server communications. The Solution Center, which serves as a central management interface for Automate deployments, transmitted specific types of data over unencrypted channels.

The cleartext transmission issue (CWE-319) represents a fundamental security flaw in secure communications design. When traffic is not protected by TLS/SSL encryption, any network-positioned attacker can perform passive interception using standard packet capture tools or conduct active man-in-the-middle attacks to intercept and potentially modify communications in transit.

Organizations using ConnectWise Automate in environments where network traffic traverses untrusted networks—such as shared enterprise networks, cloud environments, or scenarios involving remote administration—face elevated risk from this vulnerability.

Root Cause

The root cause of CVE-2026-6066 is the failure to enforce transport-layer encryption (TLS/SSL) for certain communication pathways within the ConnectWise Automate Solution Center. This represents an insecure communication design flaw where the application permitted cleartext HTTP connections instead of mandating HTTPS for all client-to-server exchanges. The issue has been resolved in Automate 2026.4 by enforcing secure communication for all affected Solution Center connections.

Attack Vector

The vulnerability requires network-level access to intercept traffic between ConnectWise Automate clients and servers. An attacker would need to be positioned on the same network segment or along the communication path to exploit this vulnerability. This could be achieved through:

• Compromising a host on the same network segment
• Conducting ARP spoofing or DNS hijacking attacks
• Gaining access to network infrastructure devices
• Operating a malicious network (e.g., rogue Wi-Fi access point)

Once positioned, the attacker could use packet capture tools to passively intercept unencrypted Solution Center communications, potentially harvesting sensitive data including configuration information, authentication tokens, or other confidential data transmitted between clients and servers.

Detection Methods for CVE-2026-6066

Indicators of Compromise

• Unencrypted HTTP traffic on ports typically used by ConnectWise Automate Solution Center
• Network packet captures showing cleartext data transmission to/from Automate servers
• Evidence of ARP spoofing or DNS hijacking targeting Automate infrastructure
• Anomalous network traffic patterns indicating man-in-the-middle activity

Detection Strategies

• Monitor network traffic for unencrypted HTTP connections to ConnectWise Automate servers
• Deploy network intrusion detection systems (NIDS) with rules to detect cleartext transmission of sensitive data patterns
• Audit network logs for evidence of traffic interception attempts or suspicious routing changes
• Review ConnectWise Automate version information to identify unpatched deployments

Monitoring Recommendations

• Implement continuous network traffic analysis for ConnectWise Automate infrastructure
• Enable TLS inspection on network security appliances to verify encryption enforcement
• Configure alerts for any HTTP (non-HTTPS) traffic to Automate Solution Center endpoints
• Monitor for signs of network-based attacks such as ARP poisoning or DNS spoofing

How to Mitigate CVE-2026-6066

Immediate Actions Required

• Upgrade ConnectWise Automate to version 2026.4 or later immediately
• Audit network traffic to identify any ongoing cleartext transmissions
• Ensure all client connections to Automate servers traverse encrypted channels
• Review network segmentation to limit exposure of Automate traffic to untrusted networks

Patch Information

ConnectWise has addressed this vulnerability in ConnectWise Automate version 2026.4. The patch enforces secure communication for all affected Solution Center connections, eliminating the cleartext transmission issue. Organizations should apply this update as soon as possible to protect against potential network-based interception attacks.

For complete patch details and upgrade instructions, refer to the ConnectWise Security Bulletin.

Workarounds

• Implement network segmentation to isolate ConnectWise Automate traffic from untrusted network segments
• Deploy VPN or other encrypted tunnel solutions for remote Automate administration until patching is complete
• Enable network-level TLS termination proxies in front of Automate servers to enforce encryption
• Monitor for and block any unencrypted connections to Automate infrastructure at the firewall level

# Verify ConnectWise Automate version to confirm patch status
# Check that your installation is running version 2026.4 or later
# Consult ConnectWise documentation for version verification commands

# Network monitoring example - detect unencrypted HTTP traffic to Automate servers
# tcpdump -i eth0 'tcp port 80 and host <automate-server-ip>' -w automate_cleartext.pcap