TI-2025-13036 Aliases CVE-2025-14265 GHSA-3hj4-mq9q-jpmj

Improper server-side validation in ScreenConnect extension framework

MEDIUM 41CWE-494Published 2025-12-11 · Updated 2026-11-03

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-494.

Summary

In versions of ScreenConnect™ prior to 25.8, server-side validation and integrity checks within the extension subsystem could allow the installation and execution of untrusted or arbitrary extensions by authorized or administrative users. Abuse of this behavior could result in the execution of custom code on the server or unauthorized access to application configuration data. This issue affects only the ScreenConnect server component; host and guest clients are not impacted. ScreenConnect 25.8 introduces enhanced server-side configuration handling and integrity checks to ensure only trusted extensions can be installed.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00368 30th percentileScored 2026-11-07

Fix Fixed ScreenConnect (ConnectWise): 2025.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
ConnectWise	ScreenConnect	before 2025.8	2025.8	Patch available	CNA

ScreenConnect VendorConnectWise Affected before 2025.8 Fixed in 2025.8 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:connectwise:screenconnect::::::::	before 25.8.0.9438	Vulnerable	ConnectWise

cpe:2.3:a:connectwise:screenconnect:*:*:*:*:*:*:*:* Versions before 25.8.0.9438 Vulnerable ·ConnectWise

Remediation

Fix · CNA ScreenConnect (ConnectWise) Fixed in 2025.8

Timeline

2026-10-02 Threatist record created from CVE-2025-14265
2026-10-03 Alias added: GHSA-3hj4-mq9q-jpmj

References

Advisory 1

https://www.connectwise.com/company/trust/security-bulletins/screenconnect-2025.8-security-patch

TI-2026-58346 ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions KEVCVSS 3.1CRITICAL 9.9
TI-2024-01589 Authentication bypass using an alternate path or channel KEVCVSS 3.1CRITICAL 10.0
TI-2024-01588 Improper limitation of a pathname to a restricted directory (“path traversal”) KEVCVSS 3.1HIGH 8.4
TI-2025-03479 ScreenConnect Exposure to ASP.NET ViewState Code Injection KEVCVSS 3.1HIGH 8.1
TI-2023-25574 ConnectWise ScreenConnect through 23.8.4 allows man-in-the-middle attackers to achieve… CVSS 3.1HIGH 8.1
TI-2025-13525 Certificate Signing Extension Returns Encrypted Values CVSS 3.1MEDIUM 5.3

See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences