What is the CVSS score of CVE-2026-39253?

CVE-2026-39253 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.8%.

Which versions of Pivotal CRM are affected by CVE-2026-39253?

Pivotal CRM 6.6.04.08 Smart Client contains a remote code execution vulnerability in its deserialization components that could allow attackers to execute arbitrary code on affected systems.

How to fix or mitigate CVE-2026-39253?

Within 24 hours: Identify all Pivotal CRM 6.6.04.08 Smart Client instances in production and development environments; retrieve and review Aurea's published remediation advisory. Within 7 days: Implement interim protective measures outlined in the vendor advisory; assess upgrade feasibility and patched version availability with Aurea support. Within 30 days: Execute upgrade to a patched Pivotal CRM version once released by vendor, or migrate to alternative CRM platform; validate remediation effectiveness per advisory.

Pivotal CRM CVE-2026-39253

HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-23 mitre

RCE Deserialization N A

8.1

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable unauthenticated deserialization (AV:N/PR:N/UI:N) yielding full RCE (C/I/A:H); AC:H reflects need for a working .NET gadget chain against the specific endpoint.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 23, 2026 - 22:20 vuln.today

CVSS changed

Jun 23, 2026 - 21:22 NVD

8.1 (HIGH)

CVE Published

Jun 23, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

An issue in Pivotal CRM v.6.6.04.08 allows a remote attacker to execute arbitrary code via the Pivotal.Core.Common.dll and Pivotal.Engine.Client.Services.Conversion.dll components.

AnalysisAI

Remote code execution in Pivotal CRM 6.6.04.08 Smart Client arises from insecure deserialization in the Pivotal.Core.Common.dll and Pivotal.Engine.Client.Services.Conversion.dll components, allowing remote attackers to execute arbitrary code on affected installations. The vendor (Aurea/Pivotal) has published a remediation advisory and a researcher has released a public technical advisory, but the issue is not currently listed in CISA KEV and SSVC indicates no observed exploitation. CVSS 8.1 reflects high impact tempered by high attack complexity, while no public exploit identified at time of analysis is corroborated by SSVC's 'Exploitation: none'.

Technical ContextAI

Pivotal CRM is a customer relationship management platform (originally Pivotal/CDC, now maintained by Aurea) deployed as a .NET-based Smart Client. The flaw resides in two .NET assemblies - Pivotal.Core.Common.dll and Pivotal.Engine.Client.Services.Conversion.dll - that handle object conversion/serialization within the client and server pipeline. The root cause is CWE-502 (Deserialization of Untrusted Data): the components deserialize attacker-controlled .NET serialized streams without type validation, a well-known sink class (BinaryFormatter / similar) that yields arbitrary code execution when combined with publicly known .NET gadget chains such as those produced by ysoserial.net. CPE data in the feed is unhelpful ('cpe:2.3:a:n/a:n/a') and the vendor advisory at support.pivotal.aurea.com (article 129552) is the authoritative product reference.

RemediationAI

Apply the remediation described in the vendor advisory at https://support.pivotal.aurea.com/article/129552-remediating-insecure-deserialization-cwe-502-in-pivotal-6-6-04-08-smart-client-pbs, which addresses the insecure deserialization in the two affected assemblies; the input data does not include an exact replacement build number, so this maps to 'Patch available per vendor advisory' and customers should confirm the precise fixed assembly versions with Aurea support. If patching is delayed, restrict network reachability of the Pivotal Smart Client services to trusted management VLANs or VPN only (side effect: remote users lose direct access and must use jump hosts), and consider blocking unauthenticated callers at a reverse proxy in front of the Pivotal endpoints handling object conversion (side effect: any legitimate unauthenticated client flow will break, so verify usage first). The researcher advisory at https://timtimxs.github.io/CVE-2026-39253-Advisory/ provides additional technical context for building detections (look for unexpected BinaryFormatter/SoapFormatter activity or known .NET gadget signatures in IIS/Pivotal logs).