CVE-2026-0696: ConnectWise PSA XSS Vulnerability

CVE-2026-0696 Overview

In ConnectWise PSA versions older than 2026.1, certain session cookies were not set with the HttpOnly attribute. In some scenarios, this could allow client-side scripts access to session cookie values, potentially enabling session hijacking through Cross-Site Scripting (XSS) attacks.

Critical Impact

Session cookies without HttpOnly protection can be accessed by malicious JavaScript, potentially allowing attackers to steal session tokens and impersonate authenticated users.

Affected Products

• ConnectWise PSA versions older than 2026.1

Discovery Timeline

• 2026-01-16 - CVE CVE-2026-0696 published to NVD
• 2026-01-16 - Last updated in NVD database

Technical Details for CVE-2026-0696

Vulnerability Analysis

This vulnerability is classified under CWE-1004 (Sensitive Cookie Without 'HttpOnly' Flag). The HttpOnly flag is a critical security mechanism that prevents client-side scripts from accessing cookie values. When session cookies lack this attribute, any JavaScript code running in the user's browser context can read the cookie values through the document.cookie API.

The vulnerability requires user interaction, specifically the victim must be exposed to a scenario where malicious JavaScript can execute in their browser session. This typically occurs through XSS attacks or by tricking users into visiting malicious pages while authenticated to ConnectWise PSA.

Root Cause

The root cause of this vulnerability is improper cookie configuration in ConnectWise PSA. Session cookies were being set without the HttpOnly attribute, which is a security oversight in the application's session management implementation. This configuration weakness violates secure coding best practices for handling sensitive authentication tokens.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker could exploit this vulnerability through the following attack chain:

1. The attacker identifies or creates an XSS vulnerability or convinces a user to execute malicious JavaScript
2. When an authenticated user's browser executes the malicious script, it reads the session cookie via document.cookie
3. The stolen session token is exfiltrated to an attacker-controlled server
4. The attacker uses the stolen session cookie to impersonate the victim and gain unauthorized access to the ConnectWise PSA application

The absence of the HttpOnly flag transforms what might be a lower-severity XSS vulnerability into a potential session hijacking attack that could compromise user accounts.

Detection Methods for CVE-2026-0696

Indicators of Compromise

• Unusual session activity from multiple IP addresses or geographic locations for the same user account
• JavaScript errors or suspicious client-side behavior in browser developer tools logs
• Unexpected session token transmissions to external domains in network traffic logs
• Evidence of XSS payloads in web application logs or user-submitted content

Detection Strategies

• Monitor web application firewall (WAF) logs for XSS attack patterns that could be leveraged to steal cookies
• Implement Content Security Policy (CSP) headers and monitor for CSP violation reports
• Review application authentication logs for anomalous session patterns or concurrent sessions from disparate locations
• Analyze network traffic for outbound connections to suspicious domains that may indicate cookie exfiltration

Monitoring Recommendations

• Enable detailed logging of authentication events and session management activities in ConnectWise PSA
• Configure alerts for multiple failed authentication attempts followed by successful logins from different IP addresses
• Implement browser-based security monitoring to detect potential XSS exploitation attempts
• Regularly audit cookie configurations across web applications to ensure security attributes are properly set

How to Mitigate CVE-2026-0696

Immediate Actions Required

• Upgrade ConnectWise PSA to version 2026.1 or later immediately
• Review session logs for any signs of unauthorized access or session anomalies
• Force logout all active sessions and require users to re-authenticate after the upgrade
• Implement additional security controls such as Content Security Policy headers to mitigate XSS risks

Patch Information

ConnectWise has released a security fix addressing this vulnerability. Organizations should upgrade to ConnectWise PSA version 2026.1 or later. For detailed patch information and download instructions, refer to the ConnectWise Security Bulletin.

Workarounds

• If immediate patching is not possible, implement a Web Application Firewall (WAF) with XSS protection rules to reduce exploitation risk
• Enable strict Content Security Policy (CSP) headers to limit JavaScript execution capabilities
• Consider implementing additional session validation mechanisms such as IP binding or user-agent verification
• Educate users about phishing and social engineering attacks that could be used to deliver XSS payloads