CVE-2026-0696 affects ConnectWise PSA versions older than 2026.1, stemming from certain session cookies lacking the HttpOnly attribute. This flaw allows client-side scripts to potentially access session cookie values, posing a risk of sensitive information disclosure. The vulnerability has a CVSS score of 6.5 (MEDIUM), indicating a network-based attack with low complexity, requiring user interaction, and potentially leading to high confidentiality impact. While the EPSS score is low, its FAUCET Risk Score is high at 94/100. Currently, there is no evidence of active exploitation, nor are there public exploits available on platforms like Metasploit, Nuclei, or ExploitDB. Despite the lack of exploit code, the vulnerability has garnered significant community discussion with 10 mentions, suggesting awareness among security researchers.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 2026.1CPE matchmatch criteria | cpe:2.3:a:connectwise:professional_service_automation:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.