How severe is CVE-2026-0696?

CVE-2026-0696 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity none, and availability none.

Is CVE-2026-0696 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (27th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-0696?

CVE-2026-0696 affects Connectwise Professional Service Automation. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-0696?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2026-0696 have an EU (EUVD) identifier?

Yes. CVE-2026-0696 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-2943.

When was CVE-2026-0696 published?

CVE-2026-0696 was published on 2026-01-16 and last updated on 2026-06-17.

CVE-2026-0696

CVE-2026-0696 is a medium-severity vulnerability in Connectwise Professional Service Automation with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-1004.

Key facts

Severity: Medium (CVSS 3.x base score 6.5)
EPSS exploit prediction: 0% (27th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-2943
Weakness: CWE-1004
Affected product: Connectwise Professional Service Automation
Published: 2026-01-16
Last modified: 2026-06-17

Description

In ConnectWise PSA versions older than 2026.1, certain session cookies were not set with the HttpOnly attribute. In some scenarios, this could allow client-side scripts access to session cookie values.

Frequently asked questions

What is CVE-2026-0696?: In ConnectWise PSA versions older than 2026.1, certain session cookies were not set with the HttpOnly attribute. In some scenarios, this could allow client-side scripts access to session cookie values.
How severe is CVE-2026-0696?: CVE-2026-0696 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity none, and availability none.
Is CVE-2026-0696 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (27th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-0696?: CVE-2026-0696 affects Connectwise Professional Service Automation. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-0696?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-0696 have an EU (EUVD) identifier?: Yes. CVE-2026-0696 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-2943.
When was CVE-2026-0696 published?: CVE-2026-0696 was published on 2026-01-16 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:connectwise:professional_service_automation:*:*:*:*:*:*:*:*

More vulnerabilities in Connectwise Professional Service Automation

CVE-2026-0695 — High (CVSS 8.7): In ConnectWise PSA versions older than 2026.1, Time Entry notes stored in the Time Entry Audit Trail may be rendered…
CVE-2025-7204 — Medium (CVSS 6.5): In ConnectWise PSA versions older than 2025.9, a vulnerability exists where authenticated users could gain access to…

All CVEs affecting Connectwise Professional Service Automation →

Other CWE-1004 vulnerabilities

CVE-2025-26844 — Critical (CVSS 9.8): An issue was discovered in Znuny through 7.1.3. A cookie is set without the HttpOnly flag.
CVE-2026-22081 — High (CVSS 8.8): This vulnerability exists in Tenda wireless routers (300Mbps Wireless Router F3 and N300 Easy Setup Router) due to the…
CVE-2026-42239 — High (CVSS 8.1): Budibase is an open-source low-code platform. Prior to version 3.35.10, the budibase:auth cookie containing the JWT…
CVE-2025-27223 — High (CVSS 7.5): TRUfusion Enterprise through 7.10.4.0 exposes the encrypted COOKIEID as an authentication mechanism for some endpoints…
CVE-2025-24318 — Medium (CVSS 6.8): Cookie policy is observable via built-in browser tools. In the presence of XSS, this could lead to full session…
CVE-2025-12031 — Medium (CVSS 5.3): HTTP Security Misconfiguration - Lacking Secure and HTTPOnly Attribute may allow reading the sensitive cookies from…

Browse all CWE-1004 vulnerabilities →