SuiteCRM Patches Eight Vulnerabilities, Including Critical Remote Code Execution Flaw
Do Son 
TL;DR
SuiteCRM published eight security advisories on October 12, 2026, fixing flaws in versions 7 and 8 of the open-source CRM. The worst of these SuiteCRM vulnerabilities, CVE-2026-100358, enables remote code execution and scores 9.4 on CVSS 4.0. Updating to 8.10.2 or 7.15.2 closes all of them.
- Total: 8 CVEs
- Severity: 1 Critical · 4 High · 2 Medium · 1 Unrated
- Actively exploited: None confirmed
- Highest severity: 9.4 (Critical · CVSSv4) — CVE-2026-100358
- Action: Apply the latest security updates now
Notable CVEs
| CVE | CVSS (CVSSv4) | Status |
|---|---|---|
| CVE-2026-100358 | 9.4 | Not exploited |
| CVE-2026-100363 | 8.8 | Not exploited |
| CVE-2026-97377 | 8.8 | Not exploited |
| CVE-2026-100364 | 7.1 | Not exploited |
| CVE-2026-100361 | 7.1 | Not exploited |
| CVE-2026-100362 | 6.9 | Not exploited |
| CVE-2026-100359 | 6.5 | Not exploited |
| CVE-2026-100360 | Awaiting analysis | Not exploited |
Why It Matters
A CRM holds customer records, sales data and internal messages. As a result, a breach can expose an entire business relationship history. Most of these bugs need only a regular user account, so one stolen login can go a long way.
How the Attacks Work
CVE-2026-100358: code injection to server takeover (CVSS 9.4)
This flaw sits in the Studio Dropdown Editor. An administrator can inject PHP code that the app saves into a file it loads on every page. The advisory warns that the result is “persistent OS-level code execution as www-data.” Worse, the injected code “survives reboots and cache clears.” Anyone who steals admin credentials could therefore keep a lasting hold on the server.
CVE-2026-100363: user to admin via the V8 API (CVSS 8.8)
The V8 REST API lets any logged-in user edit admin-only modules, including role and permission settings. In the advisory’s words, this enables “privilege escalation from a low-privileged account to administrator-equivalent control of the CRM and its data.”
CVE-2026-97377: SQL injection in the SOAP portal (CVSS 8.8)
A low-privileged portal user can inject SQL through a legacy SOAP method. That opens the door to database theft. Under certain database settings, it could even lead to remote code execution.
Other fixes
- CVE-2026-100364 and CVE-2026-100361 (CVSS 7.1): API flaws let users overwrite other users’ records and change hidden authentication fields.
- CVE-2026-100359 (CVSS 6.5): SQL injection in the Project Template module, open to any logged-in user.
- CVE-2026-100362 (CVSS 6.9): the V8 OAuth2 login reveals which usernames exist, aiding password spraying.
- CVE-2026-100360: missing edit checks on V8 relationship actions. No CVSS score is published yet.
Who is most at risk
Deployments with the V8 API turned on face the widest exposure. Five of the eight SuiteCRM vulnerabilities involve that API, and one needs no login at all. Sites that hand API tokens to ordinary staff or partner apps should move fastest. Similarly, any instance that still exposes the legacy SOAP portal should patch without delay.
Exploitation status
No exploitation in the wild has been confirmed for these SuiteCRM vulnerabilities. Likewise, no public proof-of-concept has been confirmed.
Affected Versions
- SuiteCRM 8.10.1 and earlier
- SuiteCRM 7.15.1 and earlier
Patch and Mitigation Steps
- Upgrade to SuiteCRM 8.10.2 or 7.15.2. Each advisory is listed on the SuiteCRM security advisories page.
- Disable the V8 API and legacy SOAP portal if you do not use them.
- Enforce strong passwords and multi-factor login for admin accounts.
- Check the custom directory for unexpected PHP files after patching.
- Add rate limits on the OAuth2 login endpoint to slow password spraying.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
