Loading vulnerability…
Untrusted Extension Execution in ConnectWise ScreenConnect
CVE-2025-14265 affects the extension subsystem of ConnectWise ScreenConnect server versions before 25.8. Insufficient server-side validation and code integrity checks allow authorized or administrative users to install and execute untrusted or arbitrary extensions. Exploitation can result in custom code execution on the server or unauthorized access to application configuration data. Only the server component is affected; host and guest clients are not affected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise server integrity through attacker-controlled extension execution and compromise confidentiality through unauthorized disclosure of application configuration data. No evidence of active exploitation has been reported.
If you can’t patch tonight, do this now.
Restrict extension installation to trusted extensions and tightly control authorized and administrative access to extension management. These restrictions reduce exposure but do not replace upgrading the affected server.
Patch, then assume compromise.
Upgrade affected ScreenConnect servers to version 25.8 or later. Version 25.8 strengthens server-side configuration handling and extension integrity validation. On-premises deployments require a manual upgrade; ConnectWise-managed cloud deployments have been automatically updated. Deployments using ConnectWise Automate integration should update the Automate ScreenConnect Extension to version 4.4.0.16 before upgrading ScreenConnect to 25.8.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.