VYPR
← All advisories
High severity8.8NVD Advisory· Published May 21, 2026

CVE-2026-9089

CVE-2026-9089

Description

The ConnectWise Automate™ Agent does not fully verify the authenticity of components obtained during plugin loading and self-update operations. This issue is addressed in Automate 2026.5.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

CVE-2026-9089 is a high-severity vulnerability in ConnectWise Automate Agent that allows an attacker to load unverified components during plugin and update operations, leading to potential code execution.

Vulnerability

Overview CVE-2026-9089 is a high-severity vulnerability in the ConnectWise Automate Agent, classified as CWE-494 (Download of Code Without Integrity Check). The agent fails to fully verify the authenticity of components obtained during plugin loading and self-update operations. This means that components can be processed and loaded without proper integrity verification, potentially allowing an attacker to introduce malicious code [1].

Exploitation

Conditions The vulnerability is exploitable from an adjacent network (AV:A) with low attack complexity (AC:L). No authentication is required (PR:N), and no user interaction is needed (UI:N). An attacker positioned on the same network as the agent could inject unverified components during the plugin or update process, bypassing integrity checks [1].

Impact

Successful exploitation could lead to high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H). An attacker could execute arbitrary code with the privileges of the Automate Agent, potentially compromising the entire system and any data accessible to the agent [1].

Mitigation

The issue is addressed in ConnectWise Automate version 2026.5. Cloud instances have already been updated. On-premises customers should apply the 2026.5 release as soon as possible, prioritizing within 30 days per the vendor's recommendation. No active exploits are known at the time of publication [1].

References
  1. ConnectWise Automate 2026.5 Security Update | ConnectWise

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

1

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

1

News mentions

50