What is the CVSS score of CVE-2026-0696?

CVE-2026-0696 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Professional Service Automation are affected by CVE-2026-0696?

Organizations using ConnectWise PSA should be aware of notable risk from CVE-2026-0696 rated CVSS 6.5. Exploitation could compromise the security of affected deployments.

How to fix or mitigate CVE-2026-0696?

Within 30 days: Identify affected systems running ConnectWise PSA and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Professional Service Automation CVE-2026-0696

MEDIUM

Sensitive Cookie Without 'HttpOnly' Flag (CWE-1004)

2026-01-16 7d616e1a-3288-43b1-a0dd-0a65d3e70a49

Information Disclosure Professional Service Automation

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 16, 2026 - 14:15 nvd

MEDIUM 6.5

DescriptionCVE.org

In ConnectWise PSA versions older than 2026.1, certain session cookies were not set with the HttpOnly attribute. In some scenarios, this could allow client-side scripts access to session cookie values.

AnalysisAI

Professional Service Automation contains a vulnerability that allows attackers to client-side scripts access to session cookie values (CVSS 6.5).

Technical ContextAI

affects Professional Service Automation. In ConnectWise PSA versions older than 2026.1, certain session cookies were not set with the HttpOnly attribute. In some scenarios, this could allow client-side scripts access to session cookie values.