CVE-2026-0696

Medium · 6.5

CVSS

6.5

EPSS

0.4%

Published

Jan 16, 2026

CISA due date

—

The record

In ConnectWise PSA versions older than 2026.1, certain session cookies were not set with the HttpOnly attribute. In some scenarios, this could allow client-side scripts access to session cookie values.

Affected packages

Ecosystem	Package	Introduced	Fixed