CVE-2026-29100
Published: 19 March 2026
Summary
CVE-2026-29100 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Suitecrm Suitecrm. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 13.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2026-29100 is a reflected HTML injection vulnerability (CWE-79) affecting SuiteCRM version 7.15.0, an open-source enterprise Customer Relationship Management (CRM) software application. The flaw resides in the login page, where attackers can inject arbitrary HTML content. It carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N), indicating high confidentiality impact with low integrity impact and no availability impact. The vulnerability was published on 2026-03-19.
Attackers can exploit this vulnerability remotely over the network with low complexity and no required privileges, but it necessitates user interaction. By tricking users—such as authenticated or prospective SuiteCRM users—into visiting a crafted URL pointing to the login page, attackers can inject malicious HTML. This enables phishing attacks, such as displaying fake login forms to steal credentials, or page defacement to spread misinformation or malware.
The SuiteCRM GitHub security advisory (GHSA-g7hf-3j93-rwm5) confirms that version 7.15.1 addresses the issue with a patch. Security practitioners should upgrade to SuiteCRM 7.15.1 or later and review login page inputs for sanitization as an interim measure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-13359
Vulnerability details
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. SuiteCRM 7.15.0 contains a reflected HTML injection vulnerability in the login page that allows attackers to inject arbitrary HTML content, enabling phishing attacks and page defacement. Version 7.15.1 patches…
more
the issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected HTML injection in public-facing login page directly enables T1190 exploitation; crafted malicious URLs facilitate spearphishing links (T1566.002) for credential harvesting via fake forms; explicit support for page defacement maps to external defacement (T1491.002).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 requires timely flaw remediation, directly addressing this CVE by applying the SuiteCRM 7.15.1 patch that fixes the reflected HTML injection in the login page.
SI-10 enforces input validation on the login page, preventing attackers from injecting arbitrary HTML content via crafted URLs.
SI-15 mandates output filtering for the login page, blocking reflected malicious HTML to mitigate phishing and defacement attacks.