CVE-2026-0696
📋 TL;DR
ConnectWise PSA versions before 2026.1 fail to set HttpOnly attribute on certain session cookies, potentially allowing client-side scripts to access session data. This affects organizations using vulnerable ConnectWise PSA installations. Attackers could steal session cookies to impersonate legitimate users.
💻 Affected Systems
- ConnectWise PSA
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Session hijacking leading to full account compromise, unauthorized access to sensitive business data, and potential privilege escalation within the PSA system.
Likely Case
Attackers stealing session cookies via XSS or other client-side attacks to gain unauthorized access to user accounts with limited privileges.
If Mitigated
Minimal impact if proper web application firewalls, content security policies, and input validation are implemented to prevent script injection.
🎯 Exploit Status
Requires ability to execute client-side scripts (typically via XSS) to access cookie values.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2026.1 or later
Vendor Advisory: https://www.connectwise.com/company/trust/security-bulletins/2026-01-15-psa-security-fix
Restart Required: Yes
Instructions:
1. Backup your ConnectWise PSA installation and database. 2. Apply the ConnectWise PSA 2026.1 update through the administrative interface. 3. Restart the ConnectWise PSA services. 4. Verify the update completed successfully.
🔧 Temporary Workarounds
Implement Content Security Policy
allDeploy a strict Content Security Policy to prevent script injection attacks that could exploit this vulnerability.
Web Application Firewall Rules
allConfigure WAF rules to detect and block session cookie access attempts from client-side scripts.
🧯 If You Can't Patch
- Implement strict input validation and output encoding to prevent XSS attacks
- Deploy network segmentation to limit access to ConnectWise PSA interfaces
🔍 How to Verify
Check if Vulnerable:
Check ConnectWise PSA version in administrative interface. If version is older than 2026.1, system is vulnerable.Check Version:
Check version in ConnectWise PSA administrative dashboard under System InformationVerify Fix Applied:
After updating to 2026.1 or later, verify session cookies now include HttpOnly attribute in browser developer tools.📡 Detection & Monitoring
Log Indicators:
- Unusual session creation patterns
- Multiple failed login attempts followed by successful login from different IP
Network Indicators:
- Unexpected JavaScript requests attempting to access document.cookie
- Suspicious client-side script injections
SIEM Query:
source="connectwise_psa" AND (event_type="session_hijack" OR cookie_access="unauthorized")