What is the CVSS score of CVE-2026-33289?

CVE-2026-33289 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of LDAP are affected by CVE-2026-33289?

SuiteCRM installations prior to versions 7.15.1 and 8.9.3 are vulnerable to LDAP injection attacks that could allow unauthorized users to bypass authentication or access sensitive directory…

How to fix or mitigate CVE-2026-33289?

Within 24 hours: Identify all SuiteCRM instances and their versions; disable LDAP authentication if possible or restrict LDAP service access to trusted networks only. Within 7 days: Prepare and test upgrade to SuiteCRM 7.15.1 or 8.9.3 in a non-production environment; implement WAF rules to block LDAP injection patterns in authentication requests. Within 30 days: Deploy patched SuiteCRM versions to all production systems; validate successful patching; resume normal LDAP authentication access controls.

LDAP CVE-2026-33289

HIGH

LDAP Injection (CWE-90)

2026-03-20 security-advisories@github.com

Authentication Bypass Information Disclosure LDAP Code Injection

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 20, 2026 - 00:30 vuln.today

CVE Published

Mar 20, 2026 - 00:16 nvd

HIGH 8.8

DescriptionGitHub Advisory

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, an LDAP Injection vulnerability exists in the SuiteCRM authentication flow. The application fails to properly sanitize user-supplied input before embedding it into the LDAP search filter. By injecting LDAP control characters, an unauthenticated attacker can manipulate the query logic, which can lead to authentication bypass or information disclosure. Versions 7.15.1 and 8.9.3 patch the issue.

AnalysisAI

An LDAP injection vulnerability in SuiteCRM's authentication flow allows attackers to manipulate LDAP queries by injecting control characters into user-supplied input, potentially leading to authentication bypass or information disclosure. The vulnerability affects SuiteCRM versions prior to 7.15.1 and 8.9.3, which are open-source CRM systems widely deployed in enterprise environments. While no active exploitation has been reported (not in CISA KEV), the network-exploitable nature and potential for authentication bypass makes this a serious concern for organizations using affected versions.

Technical ContextAI

The vulnerability stems from improper input sanitization in SuiteCRM's LDAP authentication module, where user-supplied credentials are directly embedded into LDAP search filters without adequate escaping of special characters. This is a classic example of CWE-90 (Improper Neutralization of Special Elements used in an LDAP Query), where metacharacters like parentheses, asterisks, and backslashes can alter the intended query structure. When SuiteCRM constructs LDAP queries for authentication, attackers can inject these control characters to modify the query logic, potentially matching unintended user entries or extracting sensitive directory information through blind injection techniques.

RemediationAI

Immediately upgrade SuiteCRM to version 7.15.1 or later for the 7.x branch, or to version 8.9.3 or later for the 8.x branch, as these versions contain the necessary patches to prevent LDAP injection attacks. Until patching is complete, consider temporarily disabling LDAP authentication if feasible, implementing additional input validation at the application firewall level to filter LDAP metacharacters, and monitoring authentication logs for suspicious patterns that might indicate injection attempts. Full remediation details and upgrade procedures are available in the vendor's security advisory at https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-26vx-rj47-x599.