Server-Side Validation Flaw in ScreenConnect by ConnectWise

CVE-2025-14265

What is CVE-2025-14265?

Prior to version 25.8, ScreenConnect contained a server-side validation and integrity check flaw within its extension subsystem. This vulnerability permitted authorized or administrative users to install and execute untrusted or arbitrary extensions, potentially allowing the execution of custom code on the server and unauthorized access to application configuration data. It is important to note that this issue exclusively affects the ScreenConnect server component while leaving host and guest clients untouched. The ScreenConnect 25.8 update rectifies this vulnerability by enhancing server-side configuration handling and integrity checks, ensuring that only trusted extensions can be installed.

References