CVE-2026-0696

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0696", "assignerOrgId": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49", "state": "PUBLISHED", "assignerShortName": "ConnectWise", "dateReserved": "2026-01-07T21:32:00.544Z", "datePublished": "2026-01-16T13:34:49.042Z", "dateUpdated": "2026-01-27T12:14:05.158Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "modules": ["PSA Desktop Client"], "product": "PSA", "vendor": "ConnectWise", "versions": [{"status": "affected", "version": "All versions prior to 2026.1"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Petar Sever (The Missing Link)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "In ConnectWise PSA versions older than 2026.1, certain session cookies were not set with the HttpOnly attribute. In some scenarios, this could allow client-side scripts access to session cookie values."}], "value": "In ConnectWise PSA versions older than 2026.1, certain session cookies were not set with the HttpOnly attribute. In some scenarios, this could allow client-side scripts access to session cookie values."}], "impacts": [{"capecId": "CAPEC-593", "descriptions": [{"lang": "en", "value": "CAPEC-593 Session Hijacking"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-1004", "description": "CWE-1004 Sensitive Cookie Without 'HttpOnly' Flag", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49", "shortName": "ConnectWise", "dateUpdated": "2026-01-27T12:14:05.158Z"}, "references": [{"url": "https://www.connectwise.com/company/trust/security-bulletins/2026-01-15-psa-security-fix"}, {"url": "https://www.themissinglink.com.au/security-advisories/cve-2026-0696"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<b>Cloud</b><br>Cloud instances are automatically being updated to the latest ConnectWise PSA release.<br><br><b>On-premise</b><br>Apply the 2026.1 release patches and ensure all desktop clients are up to date.<br><br>"}], "value": "Cloud\nCloud instances are automatically being updated to the latest ConnectWise PSA release.\n\nOn-premise\nApply the 2026.1 release patches and ensure all desktop clients are up to date."}], "source": {"discovery": "UNKNOWN"}, "title": "Session Cookies Missing HttpOnly Attribute", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-16T14:06:51.958037Z", "id": "CVE-2026-0696", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-16T14:07:10.948Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0696", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-16T14:06:51.958037Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-16T14:07:01.298Z"}}], "cna": {"title": "Session Cookies Missing HttpOnly Attribute", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Petar Sever (The Missing Link)"}], "impacts": [{"capecId": "CAPEC-593", "descriptions": [{"lang": "en", "value": "CAPEC-593 Session Hijacking"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "ConnectWise", "modules": ["PSA Desktop Client"], "product": "PSA", "versions": [{"status": "affected", "version": "All versions prior to 2026.1"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Cloud\nCloud instances are automatically being updated to the latest ConnectWise PSA release.\n\nOn-premise\nApply the 2026.1 release patches and ensure all desktop clients are up to date.", "supportingMedia": [{"type": "text/html", "value": "<b>Cloud</b><br>Cloud instances are automatically being updated to the latest ConnectWise PSA release.<br><br><b>On-premise</b><br>Apply the 2026.1 release patches and ensure all desktop clients are up to date.<br><br>", "base64": false}]}], "references": [{"url": "https://www.connectwise.com/company/trust/security-bulletins/2026-01-15-psa-security-fix"}, {"url": "https://www.themissinglink.com.au/security-advisories/cve-2026-0696"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "In ConnectWise PSA versions older than 2026.1, certain session cookies were not set with the HttpOnly attribute. In some scenarios, this could allow client-side scripts access to session cookie values.", "supportingMedia": [{"type": "text/html", "value": "In ConnectWise PSA versions older than 2026.1, certain session cookies were not set with the HttpOnly attribute. In some scenarios, this could allow client-side scripts access to session cookie values.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1004", "description": "CWE-1004 Sensitive Cookie Without 'HttpOnly' Flag"}]}], "providerMetadata": {"orgId": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49", "shortName": "ConnectWise", "dateUpdated": "2026-01-27T12:14:05.158Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0696", "state": "PUBLISHED", "dateUpdated": "2026-01-27T12:14:05.158Z", "dateReserved": "2026-01-07T21:32:00.544Z", "assignerOrgId": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49", "datePublished": "2026-01-16T13:34:49.042Z", "assignerShortName": "ConnectWise"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "modules": ["PSA Desktop Client"], "product": "PSA", "vendor": "ConnectWise", "versions": [{"status": "affected", "version": "All versions prior to 2026.1"}]}], "source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:connectwise:professional_service_automation:*:*:*:*:*:*:*:*", "matchCriteriaId": "CFB3E3A9-C554-4A40-9AB0-4881B9C30293", "versionEndExcluding": "2026.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In ConnectWise PSA versions older than 2026.1, certain session cookies were not set with the HttpOnly attribute. In some scenarios, this could allow client-side scripts access to session cookie values."}, {"lang": "es", "value": "En versiones de ConnectWise PSA anteriores a la 2026.1, ciertas cookies de sesi\u00f3n no se configuraron con el atributo HttpOnly. En algunos escenarios, esto podr\u00eda permitir que scripts del lado del cliente accedieran a los valores de las cookies de sesi\u00f3n."}], "id": "CVE-2026-0696", "lastModified": "2026-06-17T10:11:13.340", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0696", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-16T14:06:51.958037Z", "version": "2.0.3"}}]}, "published": "2026-01-16T14:15:54.940", "references": [{"source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49", "tags": ["Vendor Advisory"], "url": "https://www.connectwise.com/company/trust/security-bulletins/2026-01-15-psa-security-fix"}, {"source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49", "url": "https://www.themissinglink.com.au/security-advisories/cve-2026-0696"}], "sourceIdentifier": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1004"}], "source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T19:08:43.676569+00:00", "value": {"mitigation_remediation": ["Upgrade all on\u2011premise installations to ConnectWise PSA 2026.1 or newer.", "Ensure cloud\u2011hosted instances have automatic updates enabled to receive the 2026.1 fix promptly.", "Deploy a Content Security Policy that blocks inline scripts and restricts untrusted JavaScript execution to mitigate XSS vectors.", "Implement server\u2011side input validation and output encoding to reduce the risk of script injection.", "Configure session cookies to include the HttpOnly and Secure attributes whenever possible."], "summary": {"action": "Apply Patch", "impact": "Potential session hijacking via client\u2011side script access to session cookies"}, "threat_synthesis": {"affected_systems": "The vulnerability affects ConnectWise Professional Service Automation for both cloud\u2011hosted and on\u2011premise deployments. Any instance running a version earlier than 2026.1 is at risk; the fix is included in the 2026.1 release and later.", "description_and_impact": "In ConnectWise PSA versions older than 2026.1, session cookies are set without the HttpOnly flag, allowing any script that runs on the client side to read the cookie contents. If an attacker can inject or execute JavaScript\u2014through a separate XSS vulnerability or by delivering a malicious file\u2014he may obtain the session identifier and impersonate the authenticated user, leading to unauthorized access or exposure of data.", "risk_and_exploitability": "The CVSS score of 6.5 indicates medium severity, while the EPSS score of less than 1% suggests a low likelihood of widespread exploitation at the time of this analysis. The weakness is not listed in the CISA KEV catalog. Exploitation would require the attacker first be able to run JavaScript on the client; this typically means compromising the application through an XSS flaw or delivering a malicious file\u2014a requirement that is inferred from the description rather than directly stated."}}}}, "created": "2026-01-19T09:20:48.749791+00:00", "updated": "2026-04-18T19:15:10.611564+00:00", "vendors": ["connectwise", "connectwise$PRODUCT$psa"]}