{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-6066",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-20T16:12:51.126302Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-20T16:13:06.767Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Solution Center"
          ],
          "product": "Automate",
          "vendor": "ConnectWise",
          "versions": [
            {
              "status": "affected",
              "version": "All versions prior to 2026.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "ConnectWise has released a security update for ConnectWise Automate\u2122 that addresses a behavior in the ConnectWise Automate Solution Center where certain client-to-server communications could occur without transport-layer encryption. This could allow network\u2011based interception of Solution Center traffic in Automate deployments. The issue has been resolved in Automate 2026.4 by enforcing secure communication for affected Solution Center connections."
            }
          ],
          "value": "ConnectWise has released a security update for ConnectWise Automate\u2122 that addresses a behavior in the ConnectWise Automate Solution Center where certain client-to-server communications could occur without transport-layer encryption. This could allow network\u2011based interception of Solution Center traffic in Automate deployments. The issue has been resolved in Automate 2026.4 by enforcing secure communication for affected Solution Center connections."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-117",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-117 Interception"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-319",
              "description": "CWE-319 Cleartext transmission of sensitive information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-20T15:26:31.843Z",
        "orgId": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49",
        "shortName": "ConnectWise"
      },
      "references": [
        {
          "url": "https://www.connectwise.com/company/trust/security-bulletins/2026-04-20-connectwise-automate-bulletin"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003cb\u003eRemediation\u003c/b\u003e\u003c/p\u003e\n\n\u003cp\u003e\u003cu\u003eCloud:\u003c/u\u003e\u0026nbsp;\u003cspan\u003eNo action is required.\u0026nbsp;\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cspan\u003e\u003cu\u003eOn-Premise:\u003c/u\u003e\u0026nbsp;\u003c/span\u003e\u003cspan\u003eApply the 2026.4 release.\u003c/span\u003e\u003cspan\u003e\u003cbr\u003e\u003c/span\u003e\u003c/p\u003e\u003cp\u003eFor instruction on updating to the newest release, please\nreference this doc: \u003ca href=\"https://docs.connectwise.com/ConnectWise_Automate_Documentation/100/Automate_Release_Notes_Version_2026\"\u003eAutomate Release Notes Version 2026 - ConnectWise\u003c/a\u003e \u003c/p\u003e\u003cp\u003eAfter applying the update, on-premises customers must\nensure the following configurations are in place:\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cul\u003e\u003cli\u003eAn SSL certificate is bound to the Solution\nCenter on port 8484 to establish secure communication. Refer to the ConnectWise documentation for configuration steps: \u003ca href=\"https://docs.connectwise.com/ConnectWise_Automate_Documentation/070/270/Solution_Center_Client_and_Service_HTTPS_Update\"\u003eSolution Center Client and\nService HTTPS Update - ConnectWise\u003c/a\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eIn some environments, antivirus or endpoint\nprotection products may interfere with the Automate patch installer or service\nbehavior during upgrades. If issues are encountered during installation or\nstartup, refer to the ConnectWise documentation for recommended antivirus\nexclusions:\u003c/span\u003e\u003cspan\u003e \u003c/span\u003e\u003ca href=\"https://docs.connectwise.com/ConnectWise_Automate_Documentation/060/040/010\"\u003eAutomate Antivirus Exclusions for Windows\u003c/a\u003e\u003c/li\u003e\u003cli\u003eEnsure that the LTShare has a minimum of 1 GB of\nfree disk space prior to installation.\u003c/li\u003e\u003c/ul\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003e\n\n\n\n\n\n\n\n\u003c/p\u003e\u003cp\u003eIf you experience issues completing the update or\nrequired configuration steps, please contact \u003ca href=\"mailto:help@connectwise.com\"\u003eConnectWise\nSupport\u003c/a\u003e for assistance.\u003c/p\u003e"
            }
          ],
          "value": "Remediation\n\n\n\nCloud:\u00a0No action is required.\u00a0\n\nOn-Premise:\u00a0Apply the 2026.4 release.\n\n\nFor instruction on updating to the newest release, please\nreference this doc:  Automate Release Notes Version 2026 - ConnectWise https://docs.connectwise.com/ConnectWise_Automate_Documentation/100/Automate_Release_Notes_Version_2026  \n\nAfter applying the update, on-premises customers must\nensure the following configurations are in place:\n\n\n\n  *  An SSL certificate is bound to the Solution\nCenter on port 8484 to establish secure communication. Refer to the ConnectWise documentation for configuration steps: Solution Center Client and\nService HTTPS Update - ConnectWise\n  *  In some environments, antivirus or endpoint\nprotection products may interfere with the Automate patch installer or service\nbehavior during upgrades. If issues are encountered during installation or\nstartup, refer to the ConnectWise documentation for recommended antivirus\nexclusions:  Automate Antivirus Exclusions for Windows https://docs.connectwise.com/ConnectWise_Automate_Documentation/060/040/010 \n  *  Ensure that the LTShare has a minimum of 1 GB of\nfree disk space prior to installation.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nIf you experience issues completing the update or\nrequired configuration steps, please contact ConnectWise\nSupport for assistance."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Unencrypted Client\u2011Server Communication in ConnectWise Automate\u2122 Solution Center",
      "x_generator": {
        "engine": "Vulnogram 1.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49",
    "assignerShortName": "ConnectWise",
    "cveId": "CVE-2026-6066",
    "datePublished": "2026-04-20T15:26:31.843Z",
    "dateReserved": "2026-04-10T13:19:03.212Z",
    "dateUpdated": "2026-04-20T16:13:06.767Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-6066\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-04-20T16:12:51.126302Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-04-20T16:12:59.962Z\"}}], \"cna\": {\"title\": \"Unencrypted Client\\u2011Server Communication in ConnectWise Automate\\u2122 Solution Center\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"impacts\": [{\"capecId\": \"CAPEC-117\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-117 Interception\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"ConnectWise\", \"modules\": [\"Solution Center\"], \"product\": \"Automate\", \"versions\": [{\"status\": \"affected\", \"version\": \"All versions prior to 2026.4\"}], \"defaultStatus\": \"unaffected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Remediation\\n\\n\\n\\nCloud:\\u00a0No action is required.\\u00a0\\n\\nOn-Premise:\\u00a0Apply the 2026.4 release.\\n\\n\\nFor instruction on updating to the newest release, please\\nreference this doc:  Automate Release Notes Version 2026 - ConnectWise https://docs.connectwise.com/ConnectWise_Automate_Documentation/100/Automate_Release_Notes_Version_2026  \\n\\nAfter applying the update, on-premises customers must\\nensure the following configurations are in place:\\n\\n\\n\\n  *  An SSL certificate is bound to the Solution\\nCenter on port 8484 to establish secure communication. Refer to the ConnectWise documentation for configuration steps: Solution Center Client and\\nService HTTPS Update - ConnectWise\\n  *  In some environments, antivirus or endpoint\\nprotection products may interfere with the Automate patch installer or service\\nbehavior during upgrades. If issues are encountered during installation or\\nstartup, refer to the ConnectWise documentation for recommended antivirus\\nexclusions:  Automate Antivirus Exclusions for Windows https://docs.connectwise.com/ConnectWise_Automate_Documentation/060/040/010 \\n  *  Ensure that the LTShare has a minimum of 1 GB of\\nfree disk space prior to installation.\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\nIf you experience issues completing the update or\\nrequired configuration steps, please contact ConnectWise\\nSupport for assistance.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003e\u003cb\u003eRemediation\u003c/b\u003e\u003c/p\u003e\\n\\n\u003cp\u003e\u003cu\u003eCloud:\u003c/u\u003e\u0026nbsp;\u003cspan\u003eNo action is required.\u0026nbsp;\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cspan\u003e\u003cu\u003eOn-Premise:\u003c/u\u003e\u0026nbsp;\u003c/span\u003e\u003cspan\u003eApply the 2026.4 release.\u003c/span\u003e\u003cspan\u003e\u003cbr\u003e\u003c/span\u003e\u003c/p\u003e\u003cp\u003eFor instruction on updating to the newest release, please\\nreference this doc: \u003ca href=\\\"https://docs.connectwise.com/ConnectWise_Automate_Documentation/100/Automate_Release_Notes_Version_2026\\\"\u003eAutomate Release Notes Version 2026 - ConnectWise\u003c/a\u003e \u003c/p\u003e\u003cp\u003eAfter applying the update, on-premises customers must\\nensure the following configurations are in place:\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cul\u003e\u003cli\u003eAn SSL certificate is bound to the Solution\\nCenter on port 8484 to establish secure communication. Refer to the ConnectWise documentation for configuration steps: \u003ca href=\\\"https://docs.connectwise.com/ConnectWise_Automate_Documentation/070/270/Solution_Center_Client_and_Service_HTTPS_Update\\\"\u003eSolution Center Client and\\nService HTTPS Update - ConnectWise\u003c/a\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eIn some environments, antivirus or endpoint\\nprotection products may interfere with the Automate patch installer or service\\nbehavior during upgrades. If issues are encountered during installation or\\nstartup, refer to the ConnectWise documentation for recommended antivirus\\nexclusions:\u003c/span\u003e\u003cspan\u003e \u003c/span\u003e\u003ca href=\\\"https://docs.connectwise.com/ConnectWise_Automate_Documentation/060/040/010\\\"\u003eAutomate Antivirus Exclusions for Windows\u003c/a\u003e\u003c/li\u003e\u003cli\u003eEnsure that the LTShare has a minimum of 1 GB of\\nfree disk space prior to installation.\u003c/li\u003e\u003c/ul\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003e\\n\\n\\n\\n\\n\\n\\n\\n\u003c/p\u003e\u003cp\u003eIf you experience issues completing the update or\\nrequired configuration steps, please contact \u003ca href=\\\"mailto:help@connectwise.com\\\"\u003eConnectWise\\nSupport\u003c/a\u003e for assistance.\u003c/p\u003e\", \"base64\": false}]}], \"references\": [{\"url\": \"https://www.connectwise.com/company/trust/security-bulletins/2026-04-20-connectwise-automate-bulletin\"}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.1\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"ConnectWise has released a security update for ConnectWise Automate\\u2122 that addresses a behavior in the ConnectWise Automate Solution Center where certain client-to-server communications could occur without transport-layer encryption. This could allow network\\u2011based interception of Solution Center traffic in Automate deployments. The issue has been resolved in Automate 2026.4 by enforcing secure communication for affected Solution Center connections.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"ConnectWise has released a security update for ConnectWise Automate\\u2122 that addresses a behavior in the ConnectWise Automate Solution Center where certain client-to-server communications could occur without transport-layer encryption. This could allow network\\u2011based interception of Solution Center traffic in Automate deployments. The issue has been resolved in Automate 2026.4 by enforcing secure communication for affected Solution Center connections.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-319\", \"description\": \"CWE-319 Cleartext transmission of sensitive information\"}]}], \"providerMetadata\": {\"orgId\": \"7d616e1a-3288-43b1-a0dd-0a65d3e70a49\", \"shortName\": \"ConnectWise\", \"dateUpdated\": \"2026-04-20T15:26:31.843Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-6066\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-04-20T16:13:06.767Z\", \"dateReserved\": \"2026-04-10T13:19:03.212Z\", \"assignerOrgId\": \"7d616e1a-3288-43b1-a0dd-0a65d3e70a49\", \"datePublished\": \"2026-04-20T15:26:31.843Z\", \"assignerShortName\": \"ConnectWise\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}