PT-2026-26452 · Suitecrm · Suitecrm

Guilhermemury · Published 2026-03-19 · Updated 2026-03-20 · CVE-2026-33289

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SuiteCRM versions prior to 7.15.1 SuiteCRM versions prior to 8.9.3

Description SuiteCRM is an open-source Customer Relationship Management (CRM) software application. A flaw exists in the authentication process where the application does not properly validate user-provided input before including it in the LDAP search filter. An attacker can inject LDAP control characters to manipulate the query logic, potentially leading to authentication bypass or information disclosure. The LDAP search filter is vulnerable to manipulation through injected control characters. The vulnerable component is the authentication flow.

Recommendations Versions prior to 7.15.1 should be updated to version 7.15.1 or later. Versions prior to 8.9.3 should be updated to version 8.9.3 or later.

Exploit

Fix

Weakness Enumeration

CWE-90

Related Identifiers

CVE-2026-33289

GHSA-26VX-RJ47-X599

Affected Products

Suitecrm

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33289.json · Exploit
• https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-26vx-rj47-x599 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33289 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33289 · Security Note
• https://twitter.com/TheHackerWire/status/2034797151939932660 · Twitter Post
• https://twitter.com/CveFindCom/status/2034792894125478032 · Twitter Post
• https://twitter.com/CVEnew/status/2034841502116192614 · Twitter Post
• https://docs.suitecrm.com/admin/releases/7.15.x · Note