CVE-2026-6066 Unencrypted Client‑Server Communication in ConnectWise Automate™ Solution Center

What is CVE-2026-6066?

CVE-2026-6066 is a high-severity vulnerability in ConnectWise Automate, published on 20 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

ConnectWise has released a security update for ConnectWise Automate™ that addresses a behavior in the ConnectWise Automate Solution Center where certain client-to-server communications could occur without transport-layer encryption. This could allow network‑based interception of Solution Center traffic in Automate deployments. The issue has been resolved in Automate 2026.4 by enforcing secure communication for affected Solution Center connections.

Weakness: CWE-319

Which versions are affected by CVE-2026-6066?

It affects 1 product.

Products include Connectwise Automate.

How do I fix CVE-2026-6066?

No fix has been published for CVE-2026-6066 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-6066 being exploited?

There is no known exploitation of CVE-2026-6066 in the wild and no public exploit code.

Other vulnerabilities in ConnectWise Automate

• CVE-2021-35066 XML external entity in n/a Critical 9.8
• CVE-2020-15027 Auth bypass in n/a Critical 9.8
• CVE-2025-11492 HTTP Configuration and Encryption in Transit Critical 9.6
• CVE-2026-9089 Supply chain in Automate High 8.8
• CVE-2025-11493 Self-Update Verification Mechanism Process in ConnectWise Automate High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-h2v9-xpqq-69hx.