EspoCRM 9.3.7 Blocks Arbitrary Code Execution by Restricting Allowed Classes During Deserialization

EspoCRM users running versions older than 9.3.7 face a critical security risk that allows authenticated administrators to execute arbitrary code on their servers through unsafe data processing.

The risk

The National Vulnerability Database rates CVE-2026-47168 as critical with a CVSS score of 9.1. The flaw stems from CWE-502, or unsafe deserialization. An attacker who has gained administrator access can supply crafted serialized PHP object data. This data is stored in background MassAction or Export parameters. When the application later deserializes this stored data, it fails to restrict which classes are allowed for instantiation. This lack of restriction enables the attacker to instantiate arbitrary objects, leading to full remote code execution on the server.

Who is exposed

The vulnerability affects EspoCRM, an open-source customer relationship management application. Specifically, any installation running a version prior to 9.3.7 is exposed. The attack requires the threat actor to be an authenticated administrator. This means the initial breach must grant administrative privileges before the deserialization flaw can be leveraged for code execution. As Vector Tribune reported on 2026-10-09, similar unsafe deserialization issues have appeared in other platforms like openPDC/openHistorian, highlighting the persistent danger of this weakness class.

Cost and compliance

The source material does not provide specific data regarding financial costs, regulatory fines, or compliance impacts associated with CVE-2026-47168. Organizations must evaluate the risk based on the critical severity rating and the potential for full server compromise.

What should you do?

Managers should immediately verify their current EspoCRM version. If the system is running any version older than 9.3.7, prioritize the upgrade to the patched release. Until the update is applied, restrict administrative access to trusted personnel and monitor for unusual background task activity.

The background in plain language

Deserialization is the process of converting serialized data back into usable objects. When this process is unsafe, it means the system trusts incoming data too much. It may allow malicious code to run by creating unexpected objects. Teams usually validate data strictly to prevent this. Check whether your applications restrict which classes can be instantiated during deserialization. Limiting allowed classes stops attackers from injecting harmful code through data streams.

Background: Remote code execution vulnerabilities

Small businesses face high remote code execution risks due to limited patching resources and complex dependencies. You can mitigate this by enforcing strict input validation, maintaining an accurate IT asset inventory, and requiring vendors to demonstrate automated security regression testing for all updates.

Read the full guide: Remote Code Execution Risks and Protection for Small Businesses

What to do and how to stay safe: EspoCRM

• Verify your EspoCRM version and upgrade to 9.3.7 or later immediately.
• Audit administrator accounts to ensure only trusted personnel have access.
• Monitor server logs for unexpected code execution or unusual background tasks.
• Implement strict input validation for all serialized data in custom integrations.

Step-by-step guide: Zero-Day Vulnerabilities Meaning: How Unpatched Flaws Bypass Your Defenses

General security guidance from the Vector Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-47168?

The CVSS score is 9.1, which is rated as critical.

Which versions of EspoCRM are affected by this vulnerability?

All versions prior to 9.3.7 are affected.

Is a fix available for this issue?

Yes, the issue is fixed in version 9.3.7.