CVE-2026-29102 HIGH

CVE-2026-29102: SuiteCRM has Authenticated RCE in Modules

Vendor Suitecrm
Product SuiteCRM
Weakness CWE-94 · Code injection
Published March 19, 2026
Last update March 20, 2026
View on NVD All CVEs

CVSS base score

7.2/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, an Authenticated Remote Code Execution (RCE) vulnerability exists in SuiteCRM modules. Versions 7.15.1 and 8.9.3 patch the issue.

Key dates

02Disclosure timeline

March 19, 2026 CVE published
March 20, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-52756 WordPress WP Last Modified Info plugin <= 1.9.4 - Remote Code Execution (RCE) vulnerability CVE-2023-32697 Sqlite-jdbc vulnerable to remote code execution when JDBC url is attacker controlled CVE-2025-61774 PyVista has Dependency Confusion Vulnerability in that leads to RCE CVE-2023-5550 Moodle: rce due to lfi risk in some misconfigured shared hosting environments CVE-2026-48017 DbGate: Remote Code Execution via functionName injection in loadReader endpoint