The vulnerability permits certain client-to-server communications in ConnectWise Automate’s Solution Center to occur without transport‑layer encryption, which could allow an attacker who can observe the network to intercept and read the traffic. This loss of confidentiality can expose credentials or other sensitive data that is transmitted between clients and the server.

ConnectWise Automate deployments that use the on‑premises Solution Center are affected. The vulnerability is present in all on‑premises versions prior to the 2026.4 release; cloud‑based deployments do not require action.

The CVSS score of 7.1 indicates moderate to high risk. While the EPSS score is not available, the nature of the flaw suggests that network‑based attackers could easily exploit it, especially in environments lacking proper segmentation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through an eavesdropping network path between client machines and the Solution Center, where an interceptor can capture unencrypted packets. Due to the absence of encryption, an attacker can obtain sensitive data but cannot remotely execute code or modify data.