Is CVE-2026-59994 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-59994 being exploited in the wild.

How severe is CVE-2026-59994?

Medium severity, with a CVSS score of 4.3, published 15 October 2026.

Is there a fix for CVE-2026-59994?

Yes: fixed in 9.3.9. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-59994 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-59994?

Check whether you run Espocrm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59994: EspoCRM HTML injection in email notifications

CVE-2026-59994 · Severity: medium · CVSS 4.3 · Published 2026-10-15

EspoCRM is an open-source customer relationship management (CRM) system used by businesses to manage customer interactions and sales pipelines. An unauthenticated attacker can inject malicious HTML and JavaScript into email notification bodies, which are then displayed to users without proper escaping. In mail clients that execute embedded scripts, this could allow attackers to steal credentials, perform unauthorized actions, or compromise user accounts.

Technologies: Espocrm. Vendors: Espocrm.

Quick answers

Is CVE-2026-59994 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-59994 being exploited in the wild.
How severe is CVE-2026-59994?: Medium severity, with a CVSS score of 4.3, published 15 October 2026.
Which products and versions are affected?: Espocrm prior to 9.3.9.
Is there a fix for CVE-2026-59994?: Yes: fixed in 9.3.9. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59994 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-59994?: Check whether you run Espocrm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 9.3.9

Technical details

An unauthenticated remote attacker can send an email to monitored IMAP addresses (including email-to-Case addresses) with arbitrary HTML in the plain-text body. EspoCRM stores this body and renders it in Email Received stream notifications sent to followers without sanitization, enabling HTML injection and JavaScript execution. The vulnerability exists because earlier sanitization applied to Post and Mention notifications was not applied to the Email Received notification path, which was fixed by using Markdown transformation instead of raw HTML rendering.

Affected products

EspoCRM EspoCRM prior to 9.3.9

Timeline

2026-10-15: disclosed
2026-06-22: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.