Critical RCE in EspoCRM Allows Admins to Execute Arbitrary Code

EspoCRM has released version 9.3.7 to address a critical security vulnerability that allows for arbitrary code execution. The flaw, identified as CVE-2026-47168, affects all versions of the open-source customer relationship management application prior to this latest update.

The vulnerability stems from unsafe handling of serialized PHP objects within the application's background processes. Specifically, the MassAction and Export parameters store data that is later deserialized by the system. Because these deserialization paths fail to restrict which classes are allowed, an attacker can force the instantiation of attacker-controlled objects.

Context and Background

According to the National Vulnerability Database record, the issue is classified as CRITICAL with a CVSS score of 9.1. The weakness is categorized under CWE-502, which relates to deserialization of untrusted data. This high severity rating reflects the potential for complete server compromise if an attacker successfully exploits the deserialization chain.

The exploit requires the attacker to be an authenticated administrator. This means that while the attack surface is limited to privileged users, the impact remains severe. An adversary who gains access to an admin account can supply crafted serialized PHP object data. This data is then processed by the application without adequate validation.

Who Is Affected

Any organization running EspoCRM versions older than 9.3.7 is vulnerable to this attack. The product is an open-source CRM application widely used for managing customer interactions and sales processes. Since the flaw exists in core background functions like MassAction and Export, it affects standard operational workflows within the software.

Administrators who have access to these features are the primary vector for exploitation. If an attacker compromises an administrator account, they can leverage this privilege to inject malicious serialized data. The application then executes this data, leading to arbitrary code execution on the server hosting the CRM instance.

What should you do?

The vendor has confirmed that the issue is fixed in version 9.3.7. Users should verify their current installation version immediately. If the system is running any version prior to 9.3.7, upgrading to the latest release is necessary to mitigate this risk. Delaying the update leaves the system exposed to potential remote code execution attacks.