ConnectWise Automate CVE-2026-9089 — Improper Integrity Validation in Agent Plugin Loading and Self-Update (CWE-494) — Threadlinqs Intelligence
As of 2026-05-30, ConnectWise Automate CVE-2026-9089 — Improper Integrity Validation in Agent Plugin Loading and Self-Update (CWE-494) is a high-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 17 indicators of compromise.
Threat ID: TL-2026-0588 · Severity: HIGH · CVSS: 8.8 · Status: MONITORING · Category: VULNERABILITY
ConnectWise Automate agent versions before 2026.5 fail to fully verify the authenticity of components retrieved during plugin loading and self-update operations (CWE-494). A network-adjacent attacker
## Overview
CVE-2026-9089 is a high-severity integrity-validation flaw in the ConnectWise Automate Remote Monitoring and Management (RMM) agent, disclosed in ConnectWise security bulletin dated 2026-05-21 and assigned CVSS 3.1 base score 8.8 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The weakness, classified CWE-494 (Download of Code Without Integrity Check), affects two distinct but related agent subsystems: dynamic plugin loading and the agent's self-update workflow. In both flows, downloaded components could be processed and executed without full cryptographic verification of authenticity or integrity prior to load.
## Root Cause
The ConnectWise Automate Windows agent (LTSvc / Labtech) periodically polls its configured Automate server for management commands, plugin payloads, and agent self-updates. The vulnerable code paths accept binary components — DLL plugins and updater executables — over the agent communication channel and load or execute them on disk without enforcing a strict signature or hash check against an authoritative manifest. Where partial validation existed, it could be bypassed under certain conditions, allowing tampered components to reach the load step. The 2026.5 release introduces enhanced integrity verification across all agent components, ensuring every dynamically loaded module is validated before execution.
## Attack Model
The CVSS vector AV:A (Adjacent Network) reflects that exploitation requires the attacker to be positioned on a network path the agent traverses to reach its Automate control server — for example, the same LAN as a managed endpoint, an upstream router, a misconfigured TLS interception proxy, or a hostile network the endpoint connects through (open Wi-Fi, compromised corporate VPN concentrator, malicious cloud middlebox). With this position the attacker can perform adversary-in-the-middle (T1557) against the agent's HTTP(S) update poll — using ARP poisoning, DHCP/DNS spoofing, BGP hijack, or compromised intermediate proxy — and respond to the agent's plugin or update request with a tampered binary. Because the integrity check is incomplete or bypassable, the agent loads the attacker-controlled component as if it were vendor-signed, yielding code execution under the LTSvc service account, which on Windows endpoints runs as SYSTEM by default. No user interaction (UI:N) and no prior privileges (PR:N) on the endpoint are required.
## Supply-Chain and MSP Blast Radius
ConnectWise Automate is one of the most widely deployed RMM platforms in the Managed Service Provider ecosystem. A single Automate server typically manages hundreds to tens of thousands of endpoints across many downstream customer tenants. An attacker who gains an adjacent-network position relative to even one MSP-managed endpoint can use this flaw as a foothold; an attacker who compromises an intermediate network element along a common path (transit provider, redirector, compromised CDN edge) could potentially affect many endpoints simultaneously. Successful exploitation grants SYSTEM-level RMM agent control, which by design has privileged remote command execution, file transfer, and software deployment across managed endpoints — the same attack surface abused in the Kaseya VSA / REvil supply-chain ransomware campaign of 2021 and in prior ConnectWise ScreenConnect zero-day campaigns (e.g. CVE-2024-1709 SlashAndGrab).
## Exploit Chain
1. Initial position — Attacker establishes an adjacent network position (T1557.002 ARP cache poisoning, T1557.003 DHCP spoofing, T1071.001 hostile proxy) on a path between the Automate agent and its server, or compromises a TLS-terminating middlebox.
2. Interception — Attacker observes the agent's periodic poll (default check-in interval ~60 seconds) to the Automate server endpoint, identifying plugin-pull or self-update requests.
3. Payload substitution — Attacker responds with a tampered DLL plugin or updater binary in place of the legitimate vendor payload (T1195.002 Compromi
Target sectors: managed-service-providers, technology, financial, healthcare, government, education, retail, manufacturing, legal, professional-services
Target regions: North America, Europe, Asia-Pacific, Latin America, Global
Detections & IOCs
As of 2026-08-15, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 17 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, HIGH, threat intelligence, cybersecurity, CVE-2026-9089, T1195, T1195.002, T1199, T1190, T1557, T1557.002, T1557.003, T1129, T1059, T1059.001
