CVE-2025-14265
CVE-2025-14265 is a critical-severity vulnerability in Connectwise Screenconnect with a CVSS 3.x base score of 9.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-494.
Key facts
- Severity: Critical (CVSS 3.x base score 9.1)
- EPSS exploit prediction: 0% (24th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2025-202687
- Weakness: CWE-494
- Affected product: Connectwise Screenconnect
- Published:
- Last modified:
Description
In versions of ScreenConnect™ prior to 25.8, server-side validation and integrity checks within the extension subsystem could allow the installation and execution of untrusted or arbitrary extensions by authorized or administrative users. Abuse of this behavior could result in the execution of custom code on the server or unauthorized access to application configuration data. This issue affects only the ScreenConnect server component; host and guest clients are not impacted. ScreenConnect 25.8 introduces enhanced server-side configuration handling and integrity checks to ensure only trusted extensions can be installed.
Frequently asked questions
- What is CVE-2025-14265?
- In versions of ScreenConnect™ prior to 25.8, server-side validation and integrity checks within the extension subsystem could allow the installation and execution of untrusted or arbitrary extensions by authorized or administrative users. Abuse of this behavior could result in the execution of custom code on the server or unauthorized access to application configuration data. This issue affects only the ScreenConnect server component; host and guest clients are not impacted. ScreenConnect 25.8 introduces enhanced server-side configuration handling and integrity checks to ensure only trusted extensions can be installed.
- How severe is CVE-2025-14265?
- CVE-2025-14265 has a CVSS 3.x base score of 9.1, rated critical severity. It is exploitable over network with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
- Is CVE-2025-14265 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (24th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2025-14265?
- CVE-2025-14265 affects Connectwise Screenconnect. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2025-14265?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
- Does CVE-2025-14265 have an EU (EUVD) identifier?
- Yes. CVE-2025-14265 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-202687.
- When was CVE-2025-14265 published?
- CVE-2025-14265 was published on 2025-12-11 and last updated on 2026-06-17.
References
Affected products (1)
- cpe:2.3:a:connectwise:screenconnect:*:*:*:*:*:*:*:*
More vulnerabilities in Connectwise Screenconnect
- CVE-2024-1709 — Critical (CVSS 10.0): ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or…
- CVE-2024-1708 — High (CVSS 8.4): ConnectWise ScreenConnect 23.9.7 and prior are affected by path-traversal vulnerability, which may allow an attacker…
- CVE-2025-3935 — High (CVSS 8.1): ScreenConnect versions 25.2.3 and earlier versions may be susceptible to a ViewState code injection attack. ASP.NET Web…
- CVE-2023-47257 — High (CVSS 8.1): ConnectWise ScreenConnect through 23.8.4 allows man-in-the-middle attackers to achieve remote code execution via…
- CVE-2023-47256 — Medium (CVSS 5.5): ConnectWise ScreenConnect through 23.8.4 allows local users to connect to arbitrary relay servers via implicit trust of…
- CVE-2025-14823 — Medium (CVSS 5.3): In deployments using the ScreenConnect™ Certificate Signing Extension, encrypted configuration values including an…
All CVEs affecting Connectwise Screenconnect →
Other CWE-494 vulnerabilities
- CVE-2020-1595 — Critical (CVSS 9.9): <p>A remote code execution vulnerability exists in Microsoft SharePoint where APIs aren't properly protected from…
- CVE-2020-1210 — Critical (CVSS 9.9): <p>A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source…
- CVE-2026-42248 — Critical (CVSS 9.8): Ollama for Windows does not perform integrity or authenticity verification of downloaded update executables. Unlike…
- CVE-2026-34841 — Critical (CVSS 9.8): Bruno is an open source IDE for exploring and testing APIs. Prior to 3.2.1, Bruno was affected by a supply chain attack…
- CVE-2026-3000 — Critical (CVSS 9.8): IDExpert Windows Logon Agent developed by Changing has a Remote Code Execution vulnerability, allowing unauthenticated…
- CVE-2026-2999 — Critical (CVSS 9.8): IDExpert Windows Logon Agent developed by Changing has a Remote Code Execution vulnerability, allowing unauthenticated…