CVE-2026-0695
High
Description
In ConnectWise PSA versions older than 2026.1, Time Entry notes stored in the Time Entry Audit Trail may be rendered without applying output encoding to certain content. Under specific conditions, this may allow stored script code to execute in the context of a user’s browser when the affected content is displayed.
SeverityHigh
CVSS8.7
Exploit probability—
ProductConnectwise Professional Service Automation
PublishedJan 16, 2026
First seenJan 16, 2026
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- connectwise professional_service_automation2026.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| connectwise professional_service_automation | v < 2026.1 | 2026.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.