What is the CVSS score of CVE-2026-29102?

CVE-2026-29102 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Suitecrm are affected by CVE-2026-29102?

SuiteCRM installations are vulnerable to authenticated remote code execution, allowing attackers with valid credentials to execute arbitrary code and potentially compromise customer data, financial…

How to fix or mitigate CVE-2026-29102?

Within 24 hours: Identify all SuiteCRM instances and their versions; restrict administrative access and monitor for suspicious login activity. Within 7 days: Implement network segmentation to isolate CRM systems; disable unnecessary user account creation and enforce multi-factor authentication for all CRM access. Within 30 days: Upgrade to SuiteCRM 7.15.1 or 8.9.3; conduct security audit of CRM access logs for evidence of exploitation.

Suitecrm CVE-2026-29102

HIGH

Code Injection (CWE-94)

2026-03-19 GitHub_M

RCE Code Injection Suitecrm

7.2

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 19, 2026 - 23:00 vuln.today

CVE Published

Mar 19, 2026 - 22:53 nvd

HIGH 7.2

DescriptionGitHub Advisory

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, an Authenticated Remote Code Execution (RCE) vulnerability exists in SuiteCRM modules. Versions 7.15.1 and 8.9.3 patch the issue.

AnalysisAI

An authenticated remote code execution vulnerability exists in SuiteCRM modules that allows high-privileged users to execute arbitrary code on the server. The vulnerability affects SuiteCRM versions prior to 7.15.1 and 8.9.3, and stems from improper code injection protections (CWE-94). While exploitation requires high privileges (admin-level), successful attacks grant complete control over the CRM system containing sensitive customer data.

Technical ContextAI

SuiteCRM is an open-source Customer Relationship Management platform built on PHP that manages critical business data including customer information, sales pipelines, and marketing campaigns. The vulnerability is classified as CWE-94 (Improper Control of Generation of Code), indicating that user-controlled input is improperly sanitized before being used in code generation or execution contexts within SuiteCRM modules. The affected products are identified by CPE cpe:2.3:a:suitecrm:suitecrm:*:*:*:*:*:*:*:* covering all versions prior to the patched releases.

RemediationAI

Immediately upgrade SuiteCRM to version 7.15.1 or later for the 7.x branch, or version 8.9.3 or later for the 8.x branch, following the vendor's security advisory at https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-mr5v-wcgr-98qr. Until patching is complete, implement strict access controls for administrative accounts, enable comprehensive logging for all admin actions, and consider restricting admin panel access to specific IP ranges. Review and audit all existing administrator accounts to ensure only necessary personnel have high-privilege access.