What is the CVSS score of CVE-2026-29103?

CVE-2026-29103 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

How to fix or mitigate CVE-2026-29103?

Within 24 hours: Identify all SuiteCRM instances running versions 7.15.0 or 8.9.2 and restrict admin account access to essential personnel only; enable detailed logging of all administrative activities. Within 7 days: Upgrade to patched versions 7.15.1 or 8.9.3 immediately, or isolate affected systems from production networks if upgrade is not immediately possible. Within 30 days: Conduct security audit of all administrative activities during the vulnerability window and review admin access policies to implement principle of least privilege.

PHP CVE-2026-29103

CRITICAL

Code Injection (CWE-94)

2026-03-19 GitHub_M

PHP RCE Code Injection

9.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 19, 2026 - 23:00 vuln.today

CVE Published

Mar 19, 2026 - 22:54 nvd

CRITICAL 9.1

DescriptionGitHub Advisory

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. A Critical Remote Code Execution (RCE) vulnerability exists in SuiteCRM 7.15.0 and 8.9.2, allowing authenticated administrators to execute arbitrary system commands. This vulnerability is a direct Patch Bypass of CVE-2024-49774. Although the vendor attempted to fix the issue in version 7.14.5, the underlying flaw in ModuleScanner.php regarding PHP token parsing remains. The scanner incorrectly resets its internal state ($checkFunction flag) when encountering any single-character token (such as =, ., or ;). This allows attackers to hide dangerous function calls (e.g., system(), exec()) using variable assignments or string concatenation, completely evading the MLP security controls. Versions 7.15.1 and 8.9.3 patch the issue.

AnalysisAI

A critical remote code execution vulnerability in SuiteCRM versions 7.15.0 and 8.9.2 allows authenticated administrators to execute arbitrary system commands through a bypass of previous security patches. This vulnerability circumvents the ModuleScanner.php security controls by exploiting improper PHP token parsing that resets security checks when encountering single-character tokens, enabling attackers to hide dangerous function calls. The vulnerability represents a direct bypass of the previously patched CVE-2024-49774 and has been assigned a CVSS score of 9.1.

Technical ContextAI

SuiteCRM is an open-source enterprise Customer Relationship Management (CRM) application identified by CPE cpe:2.3:a:suitecrm:suitecrm:*:*:*:*:*:*:*:*. The vulnerability stems from CWE-94 (Improper Control of Generation of Code), specifically in the ModuleScanner.php component responsible for detecting dangerous PHP functions. The scanner's flawed token parsing logic incorrectly resets its internal $checkFunction flag when encountering any single-character token such as equals signs, periods, or semicolons, allowing attackers to obfuscate malicious function calls like system() or exec() through variable assignments or string concatenation techniques.

RemediationAI

Immediately upgrade SuiteCRM to version 7.15.1 or 8.9.3 or later, which contain the proper fix for this vulnerability as documented at https://docs.suitecrm.com/admin/releases/7.15.x. Until patching is complete, restrict administrative access to trusted users only and monitor administrator actions for suspicious command execution attempts. Given this is a patch bypass, organizations should verify their ModuleScanner.php implementation properly handles single-character tokens and consider implementing additional code execution monitoring at the system level.