What is CVE-2026-0695?

CVE-2026-0695 is a high-severity vulnerability in Connectwise Professional_service_automation, classified under Cross-site Scripting. CVSS score: 8.7/10. Published 2026-01-16.

How severe is CVE-2026-0695?

High severity. CVSS v3 base score is 8.7 out of 10.

XSS in Connectwise Professional_service_automation

CVE-2026-0695

In ConnectWise PSA versions older than 2026.1, Time Entry notes stored in the Time Entry Audit Trail may be rendered without applying output encoding to certain content. Under specific conditions, this may allow stored script code to execu…

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.003 (16.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.7 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N.

Affected products

Connectwise Professional_service_automation
Connectwise Psa — versions All versions prior to 2026.1

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

7d616e1a-3288-43b1-a0dd-0a65d3e70a49 (Vendor Advisory)
7d616e1a-3288-43b1-a0dd-0a65d3e70a49

Frequently asked questions

What is CVE-2026-0695?: CVE-2026-0695 is a high-severity vulnerability in Connectwise Professional_service_automation, classified under Cross-site Scripting. CVSS score: 8.7/10. Published 2026-01-16.
How severe is CVE-2026-0695?: High severity. CVSS v3 base score is 8.7 out of 10.