← Vulnerability Intelligence

CVE-2023-22952

High 8.8 Exploited in the wild (KEV)

Confirmed active exploitation — CISA KEV catalog

Name
Multiple SugarCRM Products Remote Code Execution Vulnerability
Added to catalog
Remediation due date (US federal)
Required action
Apply updates per vendor instructions.

Description

In SugarCRM before 12.0. Hotfix 91155, a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation.

Metrics

CVSS 3.1
8.8 (HIGH) Score source: NVD CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS — exploit probability
80% (percentile: 100) as of 2 November 2026
CWE
CWE-20, CWE-94

Affected products

sugarcrm: sugarcrm

References