CVE-2025-7204: ConnectWise PSA · Insertion of Sensitive Information Into Sent Data
Affects ConnectWise PSASource CVE Database V5
Not known to be exploited · CVSS 6.5 Medium : upgrade to 2025.9 when convenient.
Data as of 25 Oct 2026, 19:02 UTC
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 29% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 2025.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 9 Jul 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.
What to do
Upgrade ConnectWise PSA to 2025.9.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| ConnectWise PSA | Affected
| Fixed in
|
AI-suggested
European organizations should take immediate steps to mitigate this vulnerability beyond generic patching advice. First, upgrade ConnectWise PSA to version 2025.9 or later as soon as an official patch is available. Until then, restrict API access to trusted users only and enforce the principle of least privilege to limit authenticated users' ability to make API calls that return user objects. Implement strong password policies with high complexity and length requirements to reduce the effectiveness of offline brute-force attacks on exposed hashes. Enable multi-factor authentication (MFA) for all users to mitigate the risk of credential compromise leading to unauthorized access. Monitor API usage logs for unusual or excessive requests that could indicate attempts to enumerate user hashes. Conduct regular audits of user permissions and remove unnecessary privileged accounts. Consider network segmentation to isolate the PSA system and reduce exposure. Finally, educate users about the risks of credential reuse and encourage regular password changes to limit the window of opportunity for attackers.
Description
In ConnectWise PSA versions older than 2025.9, a vulnerability exists where authenticated users could gain access to sensitive user information. Specific API requests were found to return an overly verbose user object, which included encrypted password hashes for other users. Authenticated users could then retrieve these hashes. An attacker or privileged user could then use these exposed hashes to conduct offline brute-force or dictionary attacks. Such attacks could lead to credential compromise, allowing unauthorized access to accounts, and potentially privilege escalation within the system.