SuiteCRM Vulnerabilities Allow Code Execution, Data Manipulation, SSRF, DoS

CERT-Bund has released a security advisory (WID-SEC-2026-0792) concerning critical vulnerabilities in SuiteCRM, an open-source CRM application. The vulnerabilities, rated with a CVSS base score of 8.8, affect versions of SuiteCRM prior to 7.15.1 and 8.9.3. Exploitation could lead to arbitrary code execution, data manipulation, server-side request forgery (SSRF), and denial-of-service (DoS) attacks on Linux, UNIX, and Windows operating systems.

Organizations using affected versions of SuiteCRM must update to patched versions (7.15.1 or later, and 8.9.3 or later) as soon as possible to mitigate these risks. Failure to apply the updates could expose sensitive customer data and business operations to significant security threats, including unauthorized access and system disruption. This advisory highlights the ongoing need for diligent patch management for all critical business applications.