EspoCRM 9.3.7 Patch Fixes Critical Remote Code Execution Flaw

EspoCRM has released version 9.3.7 to patch a critical remote code execution vulnerability identified as CVE-2026-47168. The flaw affects all EspoCRM installations running versions earlier than 9.3.7 and allows authenticated administrators to execute arbitrary code on the server.

What happened

EspoCRM is an open source customer relationship management application that contains a severe security flaw in versions prior to 9.3.7. According to the National Vulnerability Database record for CVE-2026-47168, the issue stems from unsafe deserialization of PHP objects. An authenticated administrator can supply crafted serialized PHP object data within background MassAction or Export parameters. This data is stored by the application and later deserialized during processing. The deserialization paths in affected versions do not restrict the classes that can be instantiated.

This lack of restriction allows an attacker to instantiate attacker-controlled objects. Consequently, the attacker can achieve arbitrary code execution on the server hosting the CRM instance. The vulnerability is rated 9.1 on the CVSS scale, which classifies it as critical. The weakness is categorized under CWE-502, which relates to deserialization of untrusted data. EspoCRM has released version 9.3.7 to fix this specific issue. The update addresses the deserialization paths to prevent unauthorized object instantiation and code execution.

Why it matters

Remote code execution vulnerabilities in customer relationship management platforms pose a significant risk to organizational data integrity. Because the flaw allows arbitrary code execution on the server, an attacker who gains administrative access can potentially take full control of the underlying system. This could lead to data theft, system compromise, or lateral movement within the network.

The fact that the vulnerability is rated critical by the National Vulnerability Database highlights the severity of the potential impact. Organizations relying on EspoCRM for customer data management must prioritize this patch to protect their infrastructure. The vulnerability exists in widely used functionality such as MassAction and Export features, which are common administrative tasks. This increases the likelihood that the flaw could be triggered in a typical operational environment.

What to watch

• Monitor EspoCRM official channels for any follow-up security advisories or additional patches.
• Check system logs for unusual administrative activity involving MassAction or Export parameters.
• Verify that all instances have been successfully updated to version 9.3.7 or later.
• Review access controls to ensure only necessary personnel have administrative privileges.

Who needs to act first

Teams managing EspoCRM instances should prioritize updating exposed systems immediately. Start with instances that are accessible from the internet or have a large number of administrative users. Before applying the patch, create a full backup of the database and application files. Test the update in a non-production environment first to ensure compatibility with existing customizations.

Verify that the deserialization fix works as expected in the test environment. Roll out the update to production systems in stages, monitoring for any unexpected behavior. If immediate patching is not possible, restrict administrative access to trusted networks and review recent administrative actions for signs of compromise.

What to do and how to stay safe: EspoCRM

• Inventory all EspoCRM installations to identify versions prior to 9.3.7.
• Apply the version 9.3.7 update to all affected systems as soon as possible.
• Review administrative logs for any suspicious deserialization attempts or unauthorized code execution.
• Restrict administrative access to trusted networks until all systems are patched.

Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which EspoCRM versions are affected by CVE-2026-47168?

All EspoCRM versions prior to 9.3.7 are affected by this critical remote code execution vulnerability.

Is there a patch available for this vulnerability?

Yes, EspoCRM has released version 9.3.7 which fixes the unsafe deserialization issue.

What is the CVSS score for CVE-2026-47168?

The National Vulnerability Database rates CVE-2026-47168 with a CVSS score of 9.1, which is critical.