Deserialization Vulnerability in EspoCRM by Espo
CVE-2026-47168

9.1CRITICAL

Key Information:

Vendor

Espocrm

Status
Espocrm
Vendor
CVE Published:
15 October 2026

What is CVE-2026-47168?

EspoCRM, an open source customer relationship management application, is susceptible to a vulnerability that allows an authenticated administrator to supply malicious serialized PHP object data. This data can be stored within MassAction or Export parameters and, upon deserialization by the application, may enable the instantiation of attacker-controlled objects. If exploited, this could lead to arbitrary code execution on the server, compromising the integrity and security of the affected system. It is recommended to update to version 9.3.7 or later to mitigate this risk.

Affected Version(s)

espocrm < 9.3.7

References

https://github.com/espocrm/espocrm/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/espocrm/espocrm/commit/f48d1d26ffa05ea...
x_refsource_MISC
https://github.com/espocrm/espocrm/releases/tag/9.3.7
x_refsource_MISC

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.