PT-2026-26431 · Suitecrm · Suitecrm

Rvizx · Published 2026-03-19 · Updated 2026-03-20 · CVE-2026-29097

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions SuiteCRM versions prior to 7.15.1 SuiteCRM versions prior to 8.9.3

Description SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions prior to 7.15.1 and 8.9.3 contain a Server-Side Request Forgery (SSRF) vulnerability combined with a Denial of Service (DoS) condition in the RSS Feed Dashlet component. A Server-Side Request Forgery (SSRF) occurs when an application allows an attacker to make requests to unintended locations. This can be used to access internal resources or perform actions on behalf of the server. A Denial of Service (DoS) condition occurs when a system is made unavailable to legitimate users.

Recommendations Update SuiteCRM to version 7.15.1 or later. Update SuiteCRM to version 8.9.3 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-29097

GHSA-X3P2-QCQH-QX2M

Affected Products

Suitecrm

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29097.json · Exploit
• https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-x3p2-qcqh-qx2m · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-29097 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-29097 · Security Note
• https://twitter.com/CVEnew/status/2034841521196081167 · Twitter Post
• https://docs.suitecrm.com/admin/releases/7.15.x · Note
• https://twitter.com/infoflowcloud/status/2034842813943205935 · Twitter Post