Cyber Posture

CVE-2026-29102

High

Published: 19 March 2026

Published
19 March 2026
Modified
24 March 2026
KEV Added
—
Patch
—
CVSS Score 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0038 59.3th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Description

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, an Authenticated Remote Code Execution (RCE) vulnerability exists in SuiteCRM modules. Versions 7.15.1 and 8.9.3 patch the issue.

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match
prevent

Directly and comprehensively mitigates CVE-2026-29102 by requiring timely patching of the authenticated RCE flaw to SuiteCRM versions 7.15.1 or 8.9.3.

RA-5 Vulnerability Monitoring and Scanning partial match
prevent

Identifies the SuiteCRM RCE vulnerability through regular vulnerability scanning, enabling proactive remediation before exploitation.

SI-10 Information Input Validation partial match
prevent

Addresses the underlying CWE-94 code injection in SuiteCRM modules by enforcing validation of all information inputs to block malicious code execution.

Security SummaryAI

CVE-2026-29102 is an authenticated remote code execution (RCE) vulnerability (CWE-94) affecting SuiteCRM, an open-source enterprise Customer Relationship Management (CRM) software application. The flaw exists in SuiteCRM modules prior to versions 7.15.1 and 8.9.3, with a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

An attacker with high-level authenticated privileges, such as administrative access, can exploit this vulnerability remotely over the network with low complexity and no user interaction required. Successful exploitation allows the attacker to execute arbitrary code on the server, potentially leading to high-impact compromise of confidentiality, integrity, and availability.

SuiteCRM versions 7.15.1 and 8.9.3 address the issue with patches. Additional details are available in the SuiteCRM 7.15.x release documentation at https://docs.suitecrm.com/admin/releases/7.15.x and the GitHub security advisory at https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-mr5v-wcgr-98qr.

Details

CWE(s)
CWE-94

Affected Products

suitecrm
suitecrm
≤ 7.15.1 · 8.0.0 — 8.9.3

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

CVE-2026-29102 is an authenticated RCE vulnerability in the public-facing SuiteCRM web application, directly enabling exploitation of a public-facing application (T1190).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References