Recently modified vulnerabilities for "screenconnect screenconnect"

Where

Sort:

ScreenConnect ScreenConnectConnectWise ScreenConnect Improper Authentication Vulnerability

Risk 71

Severity

8.1

Exploited

EPSS

0.26%

Code Injection

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

ConnectWise ScreenConnect contains an improper authentication vulnerability. This vulnerability could allow a ViewState code injection attack, which could allow remote code execution if machine keys are compromised.

1 / 2

Source: CISA

First published (updated )

CVE-2025-3935

ScreenConnect ScreenConnectImproper server-side validation in ScreenConnect extension framework

Risk 72

Severity

9.1

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

In versions of ScreenConnect™ prior to 25.8, server-side validation and integrity checks within the extension subsystem could allow the installation and execution of untrusted or arbitrary extensions by authorized or administrative users. Abuse of this behavior could result in the execution of custom code on the server or unauthorized access to application configuration data. This issue affects only the ScreenConnect server component; host and guest clients are not impacted. ScreenConnect 25.8 introduces enhanced server-side configuration handling and integrity checks to ensure only trusted extensions can be installed.

Remedy

Cloud: No action is required. ScreenConnect servers hosted in “screenconnect.com” cloud (standalone and Automate/RMM integrated) or “hostedrmm.com” for Automate partners have been updated to remediate the issue.  On-prem: * ScreenConnect Partners: Please upgrade to ScreenConnect version 25.8 and update your guest clients to the same version. Visit Download | ScreenConnect page to download and apply the update (access requires a valid on-premises license). * Automate On-Prem Partners with ScreenConnect Integration: Partners using an on-premises ScreenConnect installation integrated with Automate must ensure that the Automate ScreenConnect Extension is updated to version 4.4.0.16 before upgrading the ScreenConnect server to version 25.8. Once confirmed, visit the Automate Product Updates https://docs.connectwise.com/ConnectWise_Automate_Documentation/Automate_Product_Updates page to download and apply the ScreenConnect 25.8 update.

First published (updated )

CVE-2025-14265

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.