What’s Vulnerable › Vulnerabilities
CVE-2026-29109: SuiteCRM Authenticated Remote Code Execution via Unsafe Deserialization in SavedSearch Filter Processing
- Severity: high (CVSS 7.2 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-03-20 · updated 2026-06-17
- Weakness: CWE-502
Description
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions up to and including 8.9.2 contain an unsafe deserialization vulnerability in the SavedSearch filter processing component that allows an authenticated administrator to execute arbitrary system commands on the server. `FilterDefinitionProvider.php` calls `unserialize()` on user-controlled data from the `saved_search.contents` database column without restricting instantiable classes. Version 8.9.3 patches the issue.
Affected products
- SuiteCRM: before 8.9.3 — fixed in 8.9.3
How to fix
Upgrade to a fixed version: SuiteCRM 8.9.3. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-29109 or the next vulnerability affects your stack