June 5, 2026

CVE Watchtower


← Back to CVE List

CVE-2026-0696NVD

Vulnerability Summary

In ConnectWise PSA versions older than 2026.1, certain session cookies were not set with the HttpOnly attribute. In some scenarios, this could allow client-side scripts access to session cookie values.
Severity Level
MEDIUM(6.5)
Published Date
Jan 16, 2026
Last Modified
Jan 27, 2026
Exploitation Status
UNKNOWN
Root Weakness (CWE)
CWE-1004: Unknown/Unlisted Weakness ↗
Refer to the official MITRE database for detailed architectural specifications regarding this weakness.
EPSS Score (30-Day)
Data Pending
CVSS v3.1 Base Metrics
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionRequired
ScopeUnchanged
ConfidentialityHigh
IntegrityNone
AvailabilityNone

External References