PatchTheCVECVE-2025-7204: In ConnectWise PSA versions older than 2025.9, a vulnerability exists where authenticated users could gain acc
CVE-2025-7204 is a medium-severity flaw (CVSS 6.5) affecting professional service automation. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
In ConnectWise PSA versions older than 2025.9, a vulnerability exists where authenticated users could gain access to sensitive user information. Specific API requests were found to return an overly verbose user object, which included encrypted password hashes for other users. Authenticated users could then retrieve these hashes. An attacker or privileged user could then use these exposed hashes to conduct offline brute-force or dictionary att
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 6.5 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.4% (top 71%) |
| CISA exploited list | No |
| Weakness | CWE-201 |
| Published | 2025-07-09 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2025-7204?
professional service automation: upgrade to 2025.9. Exact commands for each OS are on this page.
Is CVE-2025-7204 being exploited?
CVE-2025-7204 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2025-7204 affect?
CVE-2025-7204 affects professional service automation. Severity is medium (CVSS 6.5). In ConnectWise PSA versions older than 2025.9, a vulnerability exists where authenticated users could gain access to sensitive user information. Specific API requests were found to return an overly verbose user object, which included encryp
How urgent is CVE-2025-7204?
Priority 30/100. No elevated risk signals yet.
Software pages
ConnectWise ScreenConnect vulnerabilities
Related CVEs
- CVE-2026-0696 MEDIUM 6.5 UPGRADE In ConnectWise PSA versions older than 2026.1, certain session cookies were not set with the HttpOnly attribut
- CVE-2026-0695 HIGH 8.7 UPGRADE In ConnectWise PSA versions older than 2026.1, Time Entry notes stored in the Time Entry Audit Trail may be re