Vulnerability Description
In ConnectWise PSA versions older than 2026.1, Time Entry notes stored in the Time Entry Audit Trail may be rendered without applying output encoding to certain content. Under specific conditions, this may allow stored script code to execute in the context of a user’s browser when the affected content is displayed.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Connectwise | Professional Service Automation | < 2026.1 |
Related Weaknesses (CWE)
References
- https://www.connectwise.com/company/trust/security-bulletins/2026-01-15-psa-secuVendor Advisory
- https://www.themissinglink.com.au/security-advisories/cve-2026-0695
FAQ
What is CVE-2026-0695?
CVE-2026-0695 is a vulnerability with a CVSS score of 8.7 (HIGH). In ConnectWise PSA versions older than 2026.1, Time Entry notes stored in the Time Entry Audit Trail may be rendered without applying output encoding to certain content. Under specific conditions, thi...
How severe is CVE-2026-0695?
CVE-2026-0695 has been rated HIGH with a CVSS base score of 8.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-0695?
Check the references section above for vendor advisories and patch information. Affected products include: Connectwise Professional Service Automation.