{"id":"CVE-2025-14265","state":"PUBLISHED","title":"Improper server-side validation in ScreenConnect extension framework","description":"In versions of ScreenConnect™ prior to 25.8, server-side validation and integrity checks within the extension subsystem could allow the installation and execution of untrusted or arbitrary extensions by authorized or administrative users. Abuse of this behavior could result in the execution of custom code on the server or unauthorized access to application configuration data. This issue affects only the ScreenConnect server component; host and guest clients are not impacted. ScreenConnect 25.8 introduces enhanced server-side configuration handling and integrity checks to ensure only trusted extensions can be installed.","publishedAt":"2025-12-11T14:21:53.234Z","updatedAt":"2026-02-26T16:21:03.963Z","severity":{"score":9.1,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","source":"ConnectWise"},"assigner":"ConnectWise","products":["ConnectWise ScreenConnect"],"affected":[{"vendor":"ConnectWise","product":"ScreenConnect","defaultStatus":"unaffected","versions":[{"version":"All versions prior to 2025.8","status":"affected"}],"modules":["Web Application Server"]}],"references":["https://www.connectwise.com/company/trust/security-bulletins/screenconnect-2025.8-security-patch"],"weaknesses":["CWE-494"],"ingestedAt":"2026-10-29T20:08:31.050Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/14xxx/CVE-2025-14265.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-14265","state":"PUBLISHED","datePublished":"2025-12-11T14:21:53.234Z","dateUpdated":"2026-02-26T16:21:03.963Z","assignerShortName":"ConnectWise","assignerOrgId":"7d616e1a-3288-43b1-a0dd-0a65d3e70a49","dateReserved":"2025-12-08T12:25:20.291Z"},"containers":{"cna":{"title":"Improper server-side validation in ScreenConnect extension framework","descriptions":[{"lang":"en","value":"In versions of ScreenConnect™ prior to 25.8, server-side validation and integrity checks within the extension subsystem could allow the installation and execution of untrusted or arbitrary extensions by authorized or administrative users. Abuse of this behavior could result in the execution of custom code on the server or unauthorized access to application configuration data. This issue affects only the ScreenConnect server component; host and guest clients are not impacted. ScreenConnect 25.8 introduces enhanced server-side configuration handling and integrity checks to ensure only trusted extensions can be installed."}],"affected":[{"vendor":"ConnectWise","product":"ScreenConnect","defaultStatus":"unaffected","versions":[{"version":"All versions prior to 2025.8","status":"affected"}],"modules":["Web Application Server"]}],"references":[{"url":"https://www.connectwise.com/company/trust/security-bulletins/screenconnect-2025.8-security-patch"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-494","description":"CWE-494 Download of Code Without Integrity Check","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"ConnectWise","orgId":"7d616e1a-3288-43b1-a0dd-0a65d3e70a49","dateUpdated":"2025-12-11T21:19:13.087Z"},"credits":[{"lang":"en","type":"finder","value":"Paul Whiting (Ultraviolet Cyber)"}],"impacts":[{"capecId":"CAPEC-137","descriptions":[{"lang":"en","value":"CAPEC-137 Parameter Injection"}]}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"

Cloud: No action is required. ScreenConnect servers hosted in\n“screenconnect.com” cloud (standalone and Automate/RMM integrated) or\n“hostedrmm.com” for Automate partners have been updated to remediate the\nissue.   

\n\n\n\n\n\n

On-prem:

\n\n

\n\n\n\n\n\n\n\n\n\n
\n\n\n\n\n\n
\n\n\n\n


"}],"value":"Cloud: No action is required. ScreenConnect servers hosted in\n“screenconnect.com” cloud (standalone and Automate/RMM integrated) or\n“hostedrmm.com” for Automate partners have been updated to remediate the\nissue.   \n\n\n\n\n\n\n\nOn-prem:\n\n\n\n\n\n * ScreenConnect Partners: Please upgrade to ScreenConnect version 25.8 and update\nyour guest clients to the same version. Visit Download\n| ScreenConnect page to download and apply the update (access\nrequires a valid on-premises license). \n * Automate On-Prem Partners with\nScreenConnect Integration: \n\nPartners using an on-premises ScreenConnect installation integrated with Automate must ensure that the Automate ScreenConnect Extension is updated to version 4.4.0.16 before upgrading the ScreenConnect server to version 25.8. Once confirmed, visit the \n\n Automate Product Updates https://docs.connectwise.com/ConnectWise_Automate_Documentation/Automate_Product_Updates \n\n page to download and apply the ScreenConnect 25.8 update."}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.5.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2025-14265","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2025-12-12T04:55:51.377077Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-02-26T16:21:03.963Z"}}]}}}