CVE-2026-0696

In ConnectWise PSA versions older than 2026.1, certain session cookies were not set with the HttpOnly attribute. In some scenarios, this could allow client-side scripts access to session cookie values.

In ConnectWise PSA versions older than 2026.1, certain session cookies were not set with the HttpOnly attribute. In some scenarios, this could allow client-side scripts access to session cookie values.

En versiones de ConnectWise PSA anteriores a la 2026.1, ciertas cookies de sesión no se configuraron con el atributo HttpOnly. En algunos escenarios, esto podría permitir que scripts del lado del cliente accedieran a los valores de las cookies de sesión.