CVE-2026-29102
Published: 19 March 2026
Summary
CVE-2026-29102 is a high-severity Code Injection (CWE-94) vulnerability in Suitecrm Suitecrm. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 38.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).
Deeper analysis
CVE-2026-29102 is an authenticated remote code execution (RCE) vulnerability (CWE-94) affecting SuiteCRM, an open-source enterprise Customer Relationship Management (CRM) software application. The flaw exists in SuiteCRM modules prior to versions 7.15.1 and 8.9.3, with a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
An attacker with high-level authenticated privileges, such as administrative access, can exploit this vulnerability remotely over the network with low complexity and no user interaction required. Successful exploitation allows the attacker to execute arbitrary code on the server, potentially leading to high-impact compromise of confidentiality, integrity, and availability.
SuiteCRM versions 7.15.1 and 8.9.3 address the issue with patches. Additional details are available in the SuiteCRM 7.15.x release documentation at https://docs.suitecrm.com/admin/releases/7.15.x and the GitHub security advisory at https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-mr5v-wcgr-98qr.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-13362
Vulnerability details
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, an Authenticated Remote Code Execution (RCE) vulnerability exists in SuiteCRM modules. Versions 7.15.1 and 8.9.3 patch the issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE-2026-29102 is an authenticated RCE vulnerability in the public-facing SuiteCRM web application, directly enabling exploitation of a public-facing application (T1190).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly and comprehensively mitigates CVE-2026-29102 by requiring timely patching of the authenticated RCE flaw to SuiteCRM versions 7.15.1 or 8.9.3.
Identifies the SuiteCRM RCE vulnerability through regular vulnerability scanning, enabling proactive remediation before exploitation.
Addresses the underlying CWE-94 code injection in SuiteCRM modules by enforcing validation of all information inputs to block malicious code execution.