In ConnectWise PSA versions older than 2026.1, session cookies are set without the HttpOnly flag, allowing any script that runs on the client side to read the cookie contents. If an attacker can inject or execute JavaScript—through a separate XSS vulnerability or by delivering a malicious file—he may obtain the session identifier and impersonate the authenticated user, leading to unauthorized access or exposure of data.

The vulnerability affects ConnectWise Professional Service Automation for both cloud‑hosted and on‑premise deployments. Any instance running a version earlier than 2026.1 is at risk; the fix is included in the 2026.1 release and later.

The CVSS score of 6.5 indicates medium severity, while the EPSS score of less than 1% suggests a low likelihood of widespread exploitation at the time of this analysis. The weakness is not listed in the CISA KEV catalog. Exploitation would require the attacker first be able to run JavaScript on the client; this typically means compromising the application through an XSS flaw or delivering a malicious file—a requirement that is inferred from the description rather than directly stated.