CVE-2026-6066

{
  "id": "CVE-2026-6066",
  "sourceIdentifier": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49",
  "published": "2026-04-20T16:16:50.123",
  "lastModified": "2026-10-26T21:10:00.170",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "ConnectWise has released a security update for ConnectWise Automate™ that addresses a behavior in the ConnectWise Automate Solution Center where certain client-to-server communications could occur without transport-layer encryption. This could allow network‑based interception of Solution Center traffic in Automate deployments. The issue has been resolved in Automate 2026.4 by enforcing secure communication for affected Solution Center connections."
    },
    {
      "lang": "es",
      "value": "ConnectWise ha lanzado una actualización de seguridad para ConnectWise Automate™ que aborda un comportamiento en el Centro de Soluciones de ConnectWise Automate donde ciertas comunicaciones de cliente a servidor podrían ocurrir sin cifrado de capa de transporte. Esto podría permitir la interceptación basada en red del tráfico del Centro de Soluciones en las implementaciones de Automate. El problema se ha resuelto en Automate 2026.4 al forzar la comunicación segura para las conexiones afectadas del Centro de Soluciones."
    }
  ],
  "affected": [
    {
      "source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49",
      "affectedData": [
        {
          "vendor": "ConnectWise",
          "product": "Automate",
          "defaultStatus": "unaffected",
          "modules": [
            "Solution Center"
          ],
          "versions": [
            {
              "version": "All versions prior to 2026.4",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 4.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-20T16:12:51.126302Z",
          "id": "CVE-2026-6066",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-319"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:connectwise:automate:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "2026.4",
              "matchCriteriaId": "45F38368-7A6C-46F4-AE8A-54ED30AFDC59"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.connectwise.com/company/trust/security-bulletins/2026-04-20-connectwise-automate-bulletin",
      "source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}