PT-2026-3251 · Connectwise · Connectwise Psa

Petar Sever · Publicado 2026-01-16 · Atualizado 2026-02-23 · CVE-2026-0695

Positive Technologies (AI Summary)

CVSS v3.1

8.7

Alta

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions ConnectWise PSA versions prior to 2026.1

Description ConnectWise PSA versions older than 2026.1 may allow stored script code to execute in a user’s browser. This occurs because Time Entry notes stored in the Time Entry Audit Trail are rendered without proper output encoding for certain content. Under specific conditions, this can lead to the execution of script code within the context of a user’s browser when the affected content is displayed.

Recommendations Update to version 2026.1.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-0695

Produtos afetados

Connectwise Psa

Referências · 13

• https://osv.dev/vulnerability/CVE-2026-0695 · Aviso do Fabricante
• https://connectwise.com/company/trust/security-bulletins/2026-01-15-psa-security-fix · Aviso do Fabricante
• https://reddit.com/r/msp/comments/1qeiaag/connectwise_psa_20261_security_fix · Publicação no Reddit
• https://twitter.com/CVEnew/status/2012303249316135256 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2012199850427703731 · Publicação no Twitter
• https://twitter.com/CrowdCyber_Com/status/2013070490785501534 · Publicação no Twitter
• https://twitter.com/CveFindCom/status/2012172759879594495 · Publicação no Twitter
• https://twitter.com/Komodosec/status/2025964720117919785 · Publicação no Twitter
• https://twitter.com/Karma_X_Inc/status/2013168115266331009 · Publicação no Twitter
• https://themissinglink.com.au/security-advisories/cve-2026-0695 · Nota
• https://twitter.com/TheHackerWire/status/2012178461532799441 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-0695 · Nota de Segurança
• https://t.me/cveNotify/149980 · Publicação no Telegram