Executive brief
Pivotal CRM, a customer relationship management platform, contains a critical security vulnerability that allows remote attackers to take full control of affected systems. By sending specially crafted data to the software, an attacker can execute unauthorized commands on both the user's computer (Smart Client) and the central business server. This could lead to the theft of sensitive customer data, complete service disruption, or a total compromise of the corporate CRM environment.
Technical details
An insecure deserialization vulnerability (CWE-502) exists in Pivotal CRM v.6.6.04.08 due to the use of the .NET BinaryFormatter class without restrictive type controls. The vulnerability is located in 'Pivotal.Engine.Client.Services.Conversion.dll' (specifically the BinaryStringRepToObject method in ConversionService.cs) and 'Pivotal.Core.Common.dll'. An unauthenticated remote attacker can provide malicious Base64-encoded serialized payloads that, when processed by the server or client, trigger gadget-chain execution leading to arbitrary code execution (RCE). The issue has been fully remediated in Pivotal CRM version 6.6.5.10, which replaces BinaryFormatter with secure JSON serialization and implements a SafeSerializationBinder.
Affected products
- Aurea (Pivotal) Pivotal CRM 6.6.04.08
Timeline
- 2026-03-16: patched: Initial standalone patch released.
- 2026-06-23: disclosed: CVE-2026-39253 published.