Is CVE-2026-37712 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-37712 being exploited in the wild.

How severe is CVE-2026-37712?

Informational severity, with a CVSS score of 9.1, published 27 May 2026.

Which products and versions are affected?

Dolibarr ERP CRM 22.0.0 - 22.0.4, 24.0.0-alpha.

Is there a fix for CVE-2026-37712?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-37712 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-37712?

Check whether you run Dolibarr ERP CRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-37712: Dolibarr ERP/CRM remote code execution in cron scheduler

CVE-2026-37712 · Severity: info · CVSS 9.1 · Published 2026-05-27

Dolibarr ERP/CRM is an open-source software suite used by businesses to manage operations like inventory, sales, and projects. A critical security flaw in the system's task scheduler allows remote attackers to execute unauthorized commands on the underlying server. This could lead to a complete system takeover, theft of sensitive business data, or a total disruption of company operations.

Technologies: Dolibarr ERP CRM. Vendors: Dolibarr.

Quick answers

Is CVE-2026-37712 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-37712 being exploited in the wild.
How severe is CVE-2026-37712?: Informational severity, with a CVSS score of 9.1, published 27 May 2026.
Which products and versions are affected?: Dolibarr ERP CRM 22.0.0 - 22.0.4, 24.0.0-alpha.
Is there a fix for CVE-2026-37712?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-37712 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-37712?: Check whether you run Dolibarr ERP CRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is classified as OS Command Injection (CWE-78) and Arbitrary Code Execution. It resides in 'htdocs/cron/class/cronjob.class.php' where the 'call_user_func_array()' PHP function is used to execute scheduled jobs without sufficient restriction on the function name or arguments. An attacker can leverage this to call dangerous system functions (like 'exec' or 'system') to execute arbitrary OS commands. While Dolibarr often employs a blacklist-based security model via 'dol_eval()', this specific vector bypasses those filters by directly reaching a PHP callback sink. The vulnerability is reachable by remote attackers and can be chained with other 'dol_eval()' bypasses to achieve full system compromise.

Affected products

Dolibarr ERP/CRM 22.0.0 - 22.0.4, 24.0.0-alpha

Timeline

2026-04-10: other: CVE assigned by MITRE
2026-05-25: disclosed: Full technical write-up published by researcher bryamzxz
2026-05-27: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.