CVE-2026-0696
Medium
Description
In ConnectWise PSA versions older than 2026.1, certain session cookies were not set with the HttpOnly attribute. In some scenarios, this could allow client-side scripts access to session cookie values.
SeverityMedium
CVSS6.5
Exploit probability—
ProductConnectwise Professional Service Automation
PublishedJan 16, 2026
First seenJan 16, 2026
Weakness typeCWE-1004CWE-1004
How to fix
Update
- connectwise professional_service_automation2026.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| connectwise professional_service_automation | v < 2026.1 | 2026.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.