ConnectWise ScreenConnect CVE-2025-14265

Exploitation requires existing ScreenConnect server administrative or otherwise authorized access to the extension subsystem - the attacker must be able to install extensions, so this is a post-authentication, high-privilege abuse rather than anonymous remote exploitation. It affects only the ScreenConnect server component running a version prior to 25.8; host and guest client agents are explicitly not impacted. The limiting factors are therefore: valid admin/authorized credentials on the server, and a vulnerable pre-25.8 server build. Upgrading to 25.8 (which adds enhanced server-side configuration handling and integrity checks) removes the condition. No special non-default feature toggle is named in the description - the extension subsystem is a standard server capability - so the primary gate is privileged access, not configuration.

This is a high-CVSS (9.1) code-integrity flaw (CWE-494) in the ScreenConnect server's extension subsystem, but the real-world risk is moderated by its privilege requirement rather than being a drop-everything emergency. The provided CVSS vector (AV:N/AC:L/PR:H/UI:N/S:C) and the description agree and reinforce each other: exploitation requires 'authorized or administrative users' (PR:H), so this is NOT an unauthenticated remote takeover despite the network attack vector. The scope change (S:C) and C:H/I:H/A:H reflect that a malicious extension yields arbitrary code execution on the underlying server, effectively a privilege/trust escalation from app-admin to host code execution. Supporting signals are modest: EPSS is 0.37% (29th percentile), indicating low predicted near-term exploitation probability; the vulnerability is NOT in CISA KEV; and no public exploit code is referenced. No SSVC decision data was provided in the input. The signals are internally consistent - a genuinely dangerous post-authentication capability, but gated behind administrative access, so prioritization should track how exposed/trusted ScreenConnect admin accounts are in a given environment rather than treating this as a wormable internet-facing zero-day. Note the input 'Authentication Bypass' tag conflicts with both the description (requires authorized/admin users) and the CVSS PR:H metric - this appears to be a mislabel and should not drive triage.

An attacker who has already obtained ScreenConnect server administrative access (via stolen/weak admin credentials, a compromised operator account, or a malicious insider) uploads a crafted extension that the pre-25.8 server installs and executes without adequate integrity validation. The extension runs custom code on the server host, giving the attacker code execution and access to application configuration/secrets. No public proof-of-concept exploit is identified in the provided data, and exploitation requires high privileges plus no user interaction once admin access is held.