Vulnerability · Published Jan 16, 2026 · Assigned by ConnectWise
CVE-2026-0695Stored XSS in Time Entry Audit Trail
High 8.7
In plain English
A high-severity cross-site scripting in PSA from ConnectWise. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).
Severity (CVSS 3.1)8.7High
Exploit odds (30 days)0.3%top 79.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
In ConnectWise PSA versions older than 2026.1, Time Entry notes stored in the Time Entry Audit Trail may be rendered without applying output encoding to certain content. Under specific conditions, this may allow stored script code to execute in the context of a user’s browser when the affected content is displayed.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ConnectWise | PSA | All versions prior to 2026.1 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N