CVE-2026-0695

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0695", "assignerOrgId": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49", "state": "PUBLISHED", "assignerShortName": "ConnectWise", "dateReserved": "2026-01-07T21:31:57.230Z", "datePublished": "2026-01-16T13:34:42.833Z", "dateUpdated": "2026-01-27T12:14:38.371Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "modules": ["PSA Web Application and PSA Desktop Client"], "product": "PSA", "vendor": "ConnectWise", "versions": [{"status": "affected", "version": "All versions prior to 2026.1"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Petar Sever (The Missing Link)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "In ConnectWise PSA versions older than 2026.1, Time Entry notes stored in the Time Entry Audit Trail may be rendered without applying output encoding to certain content. Under specific conditions, this may allow stored script code to execute in the context of a user\u2019s browser when the affected content is displayed."}], "value": "In ConnectWise PSA versions older than 2026.1, Time Entry notes stored in the Time Entry Audit Trail may be rendered without applying output encoding to certain content. Under specific conditions, this may allow stored script code to execute in the context of a user\u2019s browser when the affected content is displayed."}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49", "shortName": "ConnectWise", "dateUpdated": "2026-01-27T12:14:38.371Z"}, "references": [{"url": "https://www.connectwise.com/company/trust/security-bulletins/2026-01-15-psa-security-fix"}, {"url": "https://www.themissinglink.com.au/security-advisories/cve-2026-0695"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<b>Cloud</b><br>Cloud instances are automatically being updated to the latest ConnectWise PSA release.<br><br><b>On-premise</b><br>Apply the 2026.1 release patches and ensure all desktop clients are up to date.<br>\n\n<br>"}], "value": "Cloud\nCloud instances are automatically being updated to the latest ConnectWise PSA release.\n\nOn-premise\nApply the 2026.1 release patches and ensure all desktop clients are up to date."}], "source": {"discovery": "UNKNOWN"}, "title": "Stored XSS in Time Entry Audit Trail", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-16T14:07:34.050146Z", "id": "CVE-2026-0695", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-16T14:07:48.888Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0695", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-16T14:07:34.050146Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-16T14:07:43.518Z"}}], "cna": {"title": "Stored XSS in Time Entry Audit Trail", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Petar Sever (The Missing Link)"}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "ConnectWise", "modules": ["PSA Web Application and PSA Desktop Client"], "product": "PSA", "versions": [{"status": "affected", "version": "All versions prior to 2026.1"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Cloud\nCloud instances are automatically being updated to the latest ConnectWise PSA release.\n\nOn-premise\nApply the 2026.1 release patches and ensure all desktop clients are up to date.", "supportingMedia": [{"type": "text/html", "value": "<b>Cloud</b><br>Cloud instances are automatically being updated to the latest ConnectWise PSA release.<br><br><b>On-premise</b><br>Apply the 2026.1 release patches and ensure all desktop clients are up to date.<br>\n\n<br>", "base64": false}]}], "references": [{"url": "https://www.connectwise.com/company/trust/security-bulletins/2026-01-15-psa-security-fix"}, {"url": "https://www.themissinglink.com.au/security-advisories/cve-2026-0695"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "In ConnectWise PSA versions older than 2026.1, Time Entry notes stored in the Time Entry Audit Trail may be rendered without applying output encoding to certain content. Under specific conditions, this may allow stored script code to execute in the context of a user\u2019s browser when the affected content is displayed.", "supportingMedia": [{"type": "text/html", "value": "In ConnectWise PSA versions older than 2026.1, Time Entry notes stored in the Time Entry Audit Trail may be rendered without applying output encoding to certain content. Under specific conditions, this may allow stored script code to execute in the context of a user\u2019s browser when the affected content is displayed.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49", "shortName": "ConnectWise", "dateUpdated": "2026-01-27T12:14:38.371Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0695", "state": "PUBLISHED", "dateUpdated": "2026-01-27T12:14:38.371Z", "dateReserved": "2026-01-07T21:31:57.230Z", "assignerOrgId": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49", "datePublished": "2026-01-16T13:34:42.833Z", "assignerShortName": "ConnectWise"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "modules": ["PSA Web Application and PSA Desktop Client"], "product": "PSA", "vendor": "ConnectWise", "versions": [{"status": "affected", "version": "All versions prior to 2026.1"}]}], "source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:connectwise:professional_service_automation:*:*:*:*:*:*:*:*", "matchCriteriaId": "CFB3E3A9-C554-4A40-9AB0-4881B9C30293", "versionEndExcluding": "2026.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In ConnectWise PSA versions older than 2026.1, Time Entry notes stored in the Time Entry Audit Trail may be rendered without applying output encoding to certain content. Under specific conditions, this may allow stored script code to execute in the context of a user\u2019s browser when the affected content is displayed."}, {"lang": "es", "value": "En versiones de ConnectWise PSA anteriores a 2026.1, las notas de entrada de tiempo almacenadas en la Pista de Auditor\u00eda de Entrada de Tiempo pueden ser renderizadas sin aplicar codificaci\u00f3n de salida a cierto contenido. Bajo condiciones espec\u00edficas, esto puede permitir que c\u00f3digo de script almacenado se ejecute en el contexto del navegador de un usuario cuando el contenido afectado se muestra."}], "id": "CVE-2026-0695", "lastModified": "2026-06-17T10:11:13.227", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 5.8, "source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0695", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-01-16T14:07:34.050146Z", "version": "2.0.3"}}]}, "published": "2026-01-16T14:15:54.793", "references": [{"source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49", "tags": ["Vendor Advisory"], "url": "https://www.connectwise.com/company/trust/security-bulletins/2026-01-15-psa-security-fix"}, {"source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49", "url": "https://www.themissinglink.com.au/security-advisories/cve-2026-0695"}], "sourceIdentifier": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T05:46:37.451588+00:00", "value": {"mitigation_remediation": ["Apply the 2026.1 release patches to all on\u2011premise ConnectWise PSA instances, ensuring the core application is updated to the latest version.", "Update all desktop client installations to the latest on\u2011premise patches to prevent injection of malicious content via client\u2011side entry fields.", "Restrict or audit access to the Time Entry Audit Trail, ensuring only trusted roles can view or create audit entries, and monitor for suspicious script content."], "summary": {"action": "Patch Immediately", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the ConnectWise Professional Service Automation product. All on\u2011premises installations running a release prior to 2026.1 are impacted. Cloud deployments receive automatic updates to the latest PSA version, while on\u2011premise users must manually apply the 2026.1 patch and keep desktop clients current.", "description_and_impact": "ConnectWise PSA versions older than 2026.1 contain a stored cross\u2011site scripting flaw in the Time Entry Audit Trail. When a user enters a note that includes malicious script, the content is rendered without proper output encoding. If the audit trail is viewed by a logged\u2011in user, the script executes in that user\u2019s browser scope. The attack enables an adversary to steal session cookies, deface the interface, or perform actions on behalf of the user, violating confidentiality and integrity. The weakness is a classic input validation flaw as identified by CWE\u201179.", "risk_and_exploitability": "With a CVSS base score of 8.7, this issue is high severity. The EPSS score is below 1 percent, indicating a low but non\u2011zero probability of exploitation. It is not listed in the CISA KEV catalog. Attackers are likely to target users who have access to the audit trail feature, injecting script via the Time Entry note field. Successful exploitation results in client\u2011side code execution that can lead to data theft or unauthorized actions within the user\u2019s session. The risk is therefore high for active users, but the low intrinsic exploit probability mitigates immediate threat without a known active exploit. "}}}}, "created": "2026-01-19T09:20:55.486506+00:00", "updated": "2026-04-18T06:00:08.482903+00:00", "vendors": ["connectwise", "connectwise$PRODUCT$psa"]}