PT-2026-26452 · Suitecrm · Suitecrm

Guilhermemury · Publicado 2026-03-19 · Atualizado 2026-03-20 · CVE-2026-33289

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SuiteCRM versions prior to 7.15.1 SuiteCRM versions prior to 8.9.3

Description SuiteCRM is an open-source Customer Relationship Management (CRM) software application. A flaw exists in the authentication process where the application does not properly validate user-provided input before including it in the LDAP search filter. An attacker can inject LDAP control characters to manipulate the query logic, potentially leading to authentication bypass or information disclosure. The LDAP search filter is vulnerable to manipulation through injected control characters. The vulnerable component is the authentication flow.

Recommendations Versions prior to 7.15.1 should be updated to version 7.15.1 or later. Versions prior to 8.9.3 should be updated to version 8.9.3 or later.

Exploit

Correção

Enumeração de Fraquezas

CWE-90

Identificadores relacionados

CVE-2026-33289

GHSA-26VX-RJ47-X599

Produtos afetados

Suitecrm

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33289.json · Exploit
• https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-26vx-rj47-x599 · Aviso do Fabricante
• https://twitter.com/TheHackerWire/status/2034797151939932660 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-33289 · Aviso do Fabricante
• https://twitter.com/CveFindCom/status/2034792894125478032 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-33289 · Nota de Segurança
• https://twitter.com/CVEnew/status/2034841502116192614 · Publicação no Twitter
• https://docs.suitecrm.com/admin/releases/7.15.x · Nota