Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.4

ConnectWise PSA: Cross-Site Scripting in Time Entry Notes

CVE-2026-0695 · published 9 months ago
Summary

Older versions of ConnectWise PSA store time entry notes without proper encoding. This could allow malicious code to run in a user's browser if they view the notes, potentially leading to unauthorized actions. Update to version 2026.1 or later to fix this issue.

What to do
  • Update connectwise professional_service_automation to version 2026.1 or later.
Affected software
VendorProductAffected versions
connectwise professional_service_automation < 2026.1
cpe:2.3:a:connectwise:professional_service_automation:*:*:*:*:*:*:*:*
Original advisory text
In ConnectWise PSA versions older than 2026.1, Time Entry notes stored in the Time Entry Audit Trail may be rendered without applying output encoding to certain content. Under specific conditions, ...
In ConnectWise PSA versions older than 2026.1, Time Entry notes stored in the Time Entry Audit Trail may be rendered without applying output encoding to certain content. Under specific conditions, this may allow stored script code to execute in the context of a user’s browser when the affected content is displayed.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
5.4 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published16 Jan 2026
Updated3 Nov 2026
First seen7 Mar 2026
Sources
CVE-2026-0695 · NVD
Track software like this
Free during beta