ConnectWise Automate Agent Fails Plugin Verification, CVSS 8.8

The National Vulnerability Database (NVD) has detailed CVE-2026-9089, a high-severity vulnerability affecting the ConnectWise Automate™ Agent. This flaw stems from insufficient authenticity verification of components during plugin loading and self-update operations. An attacker could potentially exploit this weakness to deliver malicious plugins or updates, compromising the agent and the systems it manages.

Rated with a CVSS score of 8.8 (High), the vulnerability presents a significant risk. Its vector, AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicates that an attacker can exploit this over an adjacent network with low attack complexity and no user interaction, leading to high impacts on confidentiality, integrity, and availability. This is a critical remote code execution vector that defenders must take seriously.

ConnectWise has addressed this issue in Automate 2026.5. Organizations running earlier versions are exposed to severe risks. The attacker’s calculus here is straightforward: compromise a widely deployed IT management agent to gain deep access into target environments. This is a supply chain attack waiting to happen, leveraging a trusted agent as a trojan horse.