ConnectWise PSA versions older than 2026.1 contain a stored cross‑site scripting flaw in the Time Entry Audit Trail. When a user enters a note that includes malicious script, the content is rendered without proper output encoding. If the audit trail is viewed by a logged‑in user, the script executes in that user’s browser scope. The attack enables an adversary to steal session cookies, deface the interface, or perform actions on behalf of the user, violating confidentiality and integrity. The weakness is a classic input validation flaw as identified by CWE‑79.

The vulnerability affects the ConnectWise Professional Service Automation product. All on‑premises installations running a release prior to 2026.1 are impacted. Cloud deployments receive automatic updates to the latest PSA version, while on‑premise users must manually apply the 2026.1 patch and keep desktop clients current.

With a CVSS base score of 8.7, this issue is high severity. The EPSS score is below 1 percent, indicating a low but non‑zero probability of exploitation. It is not listed in the CISA KEV catalog. Attackers are likely to target users who have access to the audit trail feature, injecting script via the Time Entry note field. Successful exploitation results in client‑side code execution that can lead to data theft or unauthorized actions within the user’s session. The risk is therefore high for active users, but the low intrinsic exploit probability mitigates immediate threat without a known active exploit.