CVE-2026-0695

Published: Jan 16, 2026Modified: Jan 27, 2026

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.3 / Impact: 2.7

Source: NVD

Description

In ConnectWise PSA versions older than 2026.1, Time Entry notes stored in the Time Entry Audit Trail may be rendered without applying output encoding to certain content. Under specific conditions, this may allow stored script code to execute in the context of a user’s browser when the affected content is displayed.

Affected (1)

Products: Connectwise: Professional Service Automation

1 product

Professional Service Automation

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Connectwise Professional Service Automation	Before 2026.1

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

https://www.connectwise.com/company/trust/security-bulletins/2026-01-15-psa-security-fix

Source: 7d616e1a-3288-43b1-a0dd-0a65d3e70a49

Vendor Advisory

https://www.themissinglink.com.au/security-advisories/cve-2026-0695

Source: 7d616e1a-3288-43b1-a0dd-0a65d3e70a49

Timeline

No history available yet.