ConnectWise Automate versions before 2026.4 contain a vulnerability (CVE-2026-6066) related to the cleartext transmission of sensitive information in the Solution Center component. This occurs because some client-to-server communications do not use transport-layer encryption, exposing data to potential interception by network attackers. ConnectWise addressed this issue in version 2026.4 by enforcing secure communication protocols for these connections. The CVSS 3.1 base score is 7.1, reflecting a network attack vector with low attack complexity, requiring low privileges, no user interaction, and resulting in high confidentiality impact but low integrity and no availability impact.

The vulnerability allows an attacker with network access to intercept sensitive information transmitted between clients and the ConnectWise Automate Solution Center due to lack of encryption. This could lead to disclosure of confidential data. There is no indication of integrity or availability impact. No known exploits are currently reported in the wild.

ConnectWise has released Automate version 2026.4 which enforces secure communication for the affected Solution Center connections, resolving the vulnerability. Users should upgrade to version 2026.4 or later. Patch status is not explicitly confirmed in the provided data; therefore, users should consult the official ConnectWise advisory for the latest remediation guidance.