## Overview

CVE-2026-9089 is a high-severity integrity-validation flaw in the ConnectWise Automate Remote Monitoring and Management (RMM) agent, disclosed in ConnectWise security bulletin dated 2026-05-21 and assigned CVSS 3.1 base score 8.8 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The weakness, classified CWE-494 (Download of Code Without Integrity Check), affects two distinct but related agent subsystems: dynamic plugin loading and the agent's self-update workflow. In both flows, downloaded components could be processed and executed without full cryptographic verification of authenticity or integrity prior to load.

## Root Cause

The ConnectWise Automate Windows agent (LTSvc / Labtech) periodically polls its configured Automate server for management commands, plugin payloads, and agent self-updates. The vulnerable code paths accept binary components — DLL plugins and updater executables — over the agent communication channel and load or execute them on disk without enforcing a strict signature or hash check against an authoritative manifest. Where partial validation existed, it could be bypassed under certain conditions, allowing tampered components to reach the load step. The 2026.5 release introduces enhanced integrity verification across all agent components, ensuring every dynamically loaded module is validated before execution.

## Attack Model

The CVSS vector AV:A (Adjacent Network) reflects that exploitation requires the attacker to be positioned on a network path the agent traverses to reach its Automate control server — for example, the same LAN as a managed endpoint, an upstream router, a misconfigured TLS interception proxy, or a hostile network the endpoint connects through (open Wi-Fi, compromised corporate VPN concentrator, malicious cloud middlebox). With this position the attacker can perform adversary-in-the-middle (T1557) against the agent's HTTP(S) update poll — using ARP poisoning, DHCP/DNS spoofing, BGP hijack, or compromised intermediate proxy — and respond to the agent's plugin or update request with a tampered binary. Because the integrity check is incomplete or bypassable, the agent loads the attacker-controlled component as if it were vendor-signed, yielding code execution under the LTSvc service account, which on Windows endpoints runs as SYSTEM by default. No user interaction (UI:N) and no prior privileges (PR:N) on the endpoint are required.

## Supply-Chain and MSP Blast Radius

ConnectWise Automate is one of the most widely deployed RMM platforms in the Managed Service Provider ecosystem. A single Automate server typically manages hundreds to tens of thousands of endpoints across many downstream customer tenants. An attacker who gains an adjacent-network position relative to even one MSP-managed endpoint can use this flaw as a foothold; an attacker who compromises an intermediate network element along a common path (transit provider, redirector, compromised CDN edge) could potentially affect many endpoints simultaneously. Successful exploitation grants SYSTEM-level RMM agent control, which by design has privileged remote command execution, file transfer, and software deployment across managed endpoints — the same attack surface abused in the Kaseya VSA / REvil supply-chain ransomware campaign of 2021 and in prior ConnectWise ScreenConnect zero-day campaigns (e.g. CVE-2024-1709 SlashAndGrab).

## Exploit Chain

1. Initial position — Attacker establishes an adjacent network position (T1557.002 ARP cache poisoning, T1557.003 DHCP spoofing, T1071.001 hostile proxy) on a path between the Automate agent and its server, or compromises a TLS-terminating middlebox. 2. Interception — Attacker observes the agent's periodic poll (default check-in interval ~60 seconds) to the Automate server endpoint, identifying plugin-pull or self-update requests. 3. Payload substitution — Attacker responds with a tampered DLL plugin or updater binary in place of the legitimate vendor payload (T1195.002 Compromise Software Supply Chain, T1574 Hijack Execution Flow). 4. Bypass of integrity check — Vulnerable agent code path either skips the integrity check entirely for the affected component class, accepts a forged or weak hash, or honors a server-supplied manifest the attacker controls. 5. Code execution — Agent loads the tampered DLL into LTSvc.exe or executes the updater under LocalSystem (T1129 Shared Modules; T1059 Command and Scripting Interpreter via plugin logic). 6. Persistence — Malicious payload installs as an LTSvc plugin, registers a scheduled task, creates a new Windows service, or modifies a Run key (T1543.003 Create or Modify System Process: Windows Service; T1547.001 Registry Run Keys). 7. Defense evasion — Plugin runs inside the trusted RMM process, evading EDR rules that allowlist LTSvc.exe activity (T1218 System Binary Proxy Execution, T1027 Obfuscated Files or Information). 8. Lateral movement and follow-on impact — Attacker pivots through the Automate management plane to push commands, scripts, or installers to other managed endpoints (T1021 Remote Services; T1072 Software Deployment Tools), enabling broad ransomware staging (T1486), credential theft (T1003), or data exfiltration (T1041).

## Affected Products

- ConnectWise Automate, all versions prior to 2026.5 (on-premise deployments). - ConnectWise Automate Cloud — automatically patched by ConnectWise on or before 2026-05-21.

## Detection Considerations

No indicators of compromise have been published by ConnectWise as of the disclosure date. Defensive telemetry should focus on (a) unexpected child processes of LTSvc.exe, especially scripting hosts (powershell.exe, cmd.exe, wscript.exe, cscript.exe), (b) unsigned or anomalously signed DLLs in C:\Windows\LTSvc\Plugins\, (c) agent self-update events occurring outside change windows, (d) ARP/DHCP/DNS anomalies on networks hosting Automate-managed endpoints, and (e) TLS certificate mismatches on the agent-server channel where TLS interception is not authorized.

## Remediation

On-premise: upgrade ConnectWise Automate to 2026.5 within 30 days per the vendor priority-2 guidance. Cloud: no action required, already patched. Compensating controls until patched include enforcing strict network segmentation around RMM agents, validating that agent-server TLS chains are pinned to vendor CAs only, disabling TLS interception of RMM traffic, and increasing EDR sensitivity to LTSvc.exe child process anomalies.