CVE-2026-0695: High-Severity XSS Flaw Patched in ConnectWise PSA 2026.1

ConnectWise PSA 2026.1 patches CVE-2026-0695, a high-severity stored XSS flaw with a Base Score of 8.7 that could turn a Time Entry note into a script-heavy attack vector. The issue, described as Improper Neutralization of Input During Web Page Generation, could allow a malicious actor to inject code that runs when a legitimate user, such as an administrator or finance manager, views the note in the PSA web client or Desktop app.

The update also fixes CVE-2026-0696, a 6.5-rated vulnerability targeting the integrity of user sessions by missing the HttpOnly flag on certain session cookies, which could enable cookie access by client-side code in combination with the XSS flaw. According to the security advisory, the flaws stem from Time Entry note handling and inadequate cookie configuration, and ConnectWise has stated that the PSA 2026.1 release updates input handling and session cookie configuration to address them.

Cloud instances are automatically updated to the latest release, while on-premise users are advised to apply the 2026.1 patches and ensure all desktop clients are up to date.