Critical ScreenConnect Flaw (CVE-2025-14265) Risks Config Exposure & Untrusted Extension Installation

ConnectWise has issued a security update for ScreenConnect, addressing a critical vulnerability tracked as CVE-2025-14265 with a high CVSS of 9.1 that could expose configuration data and enable the installation of untrusted extensions. The flaw is described as server-side only, affecting the ScreenConnect server component, with host and guest clients not impacted.

According to the advisory, the new ScreenConnect 25.8 patch hardens server-side validation, enforces integrity checks for extension installations, and strengthens overall security and stability, effectively preventing sideloaded extensions from being used to persist on a compromised server. For cloud users, no action is required because patched servers hosted on screenconnect[.]com or hostedrmm[.]com are already updated; on-premise partners must upgrade to version 25.8 and also update guest clients. ConnectWise has confirmed that there is currently no evidence of exploitation in the wild.