PT-2026-3251 · Connectwise · Connectwise Psa

Petar Sever · Published 2026-01-16 · Updated 2026-02-23 · CVE-2026-0695

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions ConnectWise PSA versions prior to 2026.1

Description ConnectWise PSA versions older than 2026.1 may allow stored script code to execute in a user’s browser. This occurs because Time Entry notes stored in the Time Entry Audit Trail are rendered without proper output encoding for certain content. Under specific conditions, this can lead to the execution of script code within the context of a user’s browser when the affected content is displayed.

Recommendations Update to version 2026.1.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-0695

Affected Products

Connectwise Psa

References · 13

• https://osv.dev/vulnerability/CVE-2026-0695 · Vendor Advisory
• https://connectwise.com/company/trust/security-bulletins/2026-01-15-psa-security-fix · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-0695 · Security Note
• https://reddit.com/r/msp/comments/1qeiaag/connectwise_psa_20261_security_fix · Reddit Post
• https://twitter.com/CVEnew/status/2012303249316135256 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2012199850427703731 · Twitter Post
• https://twitter.com/CrowdCyber_Com/status/2013070490785501534 · Twitter Post
• https://twitter.com/CveFindCom/status/2012172759879594495 · Twitter Post
• https://twitter.com/Komodosec/status/2025964720117919785 · Twitter Post
• https://twitter.com/Karma_X_Inc/status/2013168115266331009 · Twitter Post
• https://themissinglink.com.au/security-advisories/cve-2026-0695 · Note
• https://twitter.com/TheHackerWire/status/2012178461532799441 · Twitter Post
• https://t.me/cveNotify/149980 · Telegram Post