Raw vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:HSummary
CVE-2026-29103 is a critical-severity Code Injection (CWE-94) vulnerability in Suitecrm Suitecrm. Its CVSS base score is 9.1 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Downgrade Attack (T1689); ranked at the 40th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-29103 is a critical remote code execution (RCE) vulnerability in SuiteCRM, an open-source enterprise Customer Relationship Management (CRM) software. It affects versions 7.15.0 and 8.9.2 due to a direct patch bypass of CVE-2024-49774 in the ModuleScanner.php component. The underlying issue involves flawed PHP token parsing, where the scanner incorrectly resets its internal $checkFunction flag upon encountering single-character tokens such as '=', '.', or ';'. This flaw enables attackers to hide dangerous function calls like system() or exec() using variable assignments or string concatenation, fully evading the MLP security controls. The vulnerability is rated 9.1 on CVSS 3.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) and maps to CWE-94 (Code Injection) and CWE-358 (Improperly Implemented Security Check).
Authenticated administrators can exploit this vulnerability remotely with low complexity to execute arbitrary system commands on the server. By crafting inputs that leverage the token parsing flaw, attackers bypass the intended protections from the prior patch attempt in version 7.14.5, achieving high impacts across confidentiality, integrity, and availability in a changed scope environment.
SuiteCRM versions 7.15.1 and 8.9.3 address the issue with a proper fix. Mitigation details are available in the vendor's release notes at https://docs.suitecrm.com/admin/releases/7.15.x and the GitHub security advisory at https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-5jjq-9qch-9rg7.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-13364
Vulnerability Data
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. A Critical Remote Code Execution (RCE) vulnerability exists in SuiteCRM 7.15.0 and 8.9.2, allowing authenticated administrators to execute arbitrary system commands. This vulnerability is a direct Patch Bypass of…
more
CVE-2024-49774. Although the vendor attempted to fix the issue in version 7.14.5, the underlying flaw in ModuleScanner.php regarding PHP token parsing remains. The scanner incorrectly resets its internal state ($checkFunction flag) when encountering any single-character token (such as =, ., or ;). This allows attackers to hide dangerous function calls (e.g., system(), exec()) using variable assignments or string concatenation, completely evading the MLP security controls. Versions 7.15.1 and 8.9.3 patch the issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V17.2.8V1.3.1
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation finds code paths that accept and execute externally influenced strings.
Input validation directly stops untrusted data from being used to construct executable code without neutralization.
Least privilege limits the damage an injected code fragment can perform once executed.
Requiring documented secure development standards and tools enforces use of safe code-generation APIs and escaping.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
PR.PS-06's SDLC practices directly target injection flaws via secure coding and testing (mostly), yet as a single broad outcome it leaves many code-generation specifics unaddressed (partial).
PR.DS-10 protects runtime data confidentiality/integrity but has no bearing on neutralizing externally influenced input during code generation, so neither direction shows any preventive effect.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development and acceptance validates that required security checks function as specified.
Use of cryptography control depends on correct implementation of standardized cryptographic checks.
Secure development life cycle mandates verification that security checks required by standards are correctly implemented.
Application security requirements explicitly call for correct implementation of standardized security mechanisms.
Secure system architecture and engineering principles require faithful realization of protocol-level security checks.
Banning unapproved code samples and unauthenticated web services, combined with secure-coding standards and SAST, prevents the dynamic generation or inclusion of attacker-supplied code.