CVE-2021-32582: ConnectWise Automate

High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days.

An issue was discovered in ConnectWise Automate before 2021.5. A blind SQL injection vulnerability exists in core agent inventory communication that can enable an attacker to extract database information or administrative credentials from an instance via crafted monitor status responses.

Affected products

• ConnectWise ConnectWise Automate: before 2021.5 (fixed in 2021.5)

Published 2021-06-17. Last modified 2026-06-17.