CVE-2025-14265: Improper server-side validation in ScreenConnect extension framework

Q: What is the severity of CVE-2025-14265?

CVE-2025-14265 is considered high severity due to the potential for unauthorized installation and execution of untrusted extensions.

Q: How do I fix CVE-2025-14265?

To fix CVE-2025-14265, upgrade to ScreenConnect version 25.8 or later where the vulnerability has been addressed.

Q: What type of vulnerability is CVE-2025-14265?

CVE-2025-14265 is a server-side validation and integrity check failure in the extension subsystem.

Q: Who is affected by CVE-2025-14265?

Authorized or administrative users of ScreenConnect versions prior to 25.8 are affected by CVE-2025-14265.

Q: What could be the consequence of exploiting CVE-2025-14265?

Exploiting CVE-2025-14265 could lead to the installation and execution of arbitrary extensions, posing security risks.

Published Dec 11, 2025

Updated

In versions of ScreenConnect™ prior to 25.8, server-side validation and integrity checks within the extension subsystem could allow the installation and execution of untrusted or arbitrary extensions by authorized or administrative users. Abuse of this behavior could result in the execution of custom code on the server or unauthorized access to application configuration data. This issue affects only the ScreenConnect server component; host and guest clients are not impacted. ScreenConnect 25.8 introduces enhanced server-side configuration handling and integrity checks to ensure only trusted extensions can be installed.

Affected Software

2 affected components

ScreenConnect ScreenConnect<25.8

ConnectWise ScreenConnect<25.8.0.9438

Remediation

Information

Cloud: No action is required. ScreenConnect servers hosted in “screenconnect.com” cloud (standalone and Automate/RMM integrated) or “hostedrmm.com” for Automate partners have been updated to remediate the issue.  On-prem: * ScreenConnect Partners: Please upgrade to ScreenConnect version 25.8 and update your guest clients to the same version. Visit Download | ScreenConnect page to download and apply the update (access requires a valid on-premises license). * Automate On-Prem Partners with ScreenConnect Integration: Partners using an on-premises ScreenConnect installation integrated with Automate must ensure that the Automate ScreenConnect Extension is updated to version 4.4.0.16 before upgrading the ScreenConnect server to version 25.8. Once confirmed, visit the Automate Product Updates https://docs.connectwise.com/ConnectWise_Automate_Documentation/Automate_Product_Updates page to download and apply the ScreenConnect 25.8 update.

Event History

Dec 11, 2025

CVE Published

via MITRE·02:21 PM

Data Sourced

via MITRE·02:21 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·03:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-14265?

CVE-2025-14265 is considered high severity due to the potential for unauthorized installation and execution of untrusted extensions.

How do I fix CVE-2025-14265?

To fix CVE-2025-14265, upgrade to ScreenConnect version 25.8 or later where the vulnerability has been addressed.

What type of vulnerability is CVE-2025-14265?