« Volver al listado

CVE-2026-0696

Estado: ModificadaMedia (6.5)—

In ConnectWise PSA versions older than 2026.1, certain session cookies were not set with the HttpOnly attribute. In some scenarios, this could allow client-side scripts access to session cookie values.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Connectwise — Professional Service Automation

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-0696",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-0696",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-01-16T14:06:51.958037Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49",
      "affectedData": [
        {
          "vendor": "ConnectWise",
          "modules": [
            "PSA Desktop Client"
          ],
          "product": "PSA",
          "versions": [
            {
              "status": "affected",
              "version": "All versions prior to 2026.1"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-01-16T14:15:54.940",
  "references": [
    {
      "url": "https://www.connectwise.com/company/trust/security-bulletins/2026-01-15-psa-security-fix",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49"
    },
    {
      "url": "https://www.themissinglink.com.au/security-advisories/cve-2026-0696",
      "source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1004"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In ConnectWise PSA versions older than 2026.1, certain session cookies were not set with the HttpOnly attribute. In some scenarios, this could allow client-side scripts access to session cookie values."
    },
    {
      "lang": "es",
      "value": "En versiones de ConnectWise PSA anteriores a la 2026.1, ciertas cookies de sesión no se configuraron con el atributo HttpOnly. En algunos escenarios, esto podría permitir que scripts del lado del cliente accedieran a los valores de las cookies de sesión."
    }
  ],
  "lastModified": "2026-06-17T10:11:13.340",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:connectwise:professional_service_automation:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CFB3E3A9-C554-4A40-9AB0-4881B9C30293",
              "versionEndExcluding": "2026.1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49"
}