CVE-2026-29102: SuiteCRM has Authenticated RCE in Modules
Published Mar 19, 2026
·Updated
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, an Authenticated Remote Code Execution (RCE) vulnerability exists in SuiteCRM modules. Versions 7.15.1 and 8.9.3 patch the issue.
Affected Software
3 affected components
SuiteCRM SuiteCRM<7.15.1, <8.9.3
SuiteCRM SuiteCRM<7.15.1
SuiteCRM SuiteCRM>=8.0.0<8.9.3
Event History
Mar 19, 2026
CVE Published
via MITRE·10:53 PM
Data Sourced
via MITRE·10:53 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·11:16 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-29102?
CVE-2026-29102 is classified as a critical vulnerability due to its potential for Authenticated Remote Code Execution.
2
How do I fix CVE-2026-29102?
To fix CVE-2026-29102, upgrade SuiteCRM to versions 7.15.1 or 8.9.3 or later.
3
Who is affected by CVE-2026-29102?
Users of SuiteCRM versions prior to 7.15.1 and 8.9.3 are affected by CVE-2026-29102.
4
What type of vulnerability is CVE-2026-29102?
CVE-2026-29102 is an Authenticated Remote Code Execution (RCE) vulnerability affecting SuiteCRM.
5
When was CVE-2026-29102 disclosed?
CVE-2026-29102 was disclosed in 2026, detailing its presence in earlier versions of SuiteCRM.