Is CVE-2026-61653 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-61653 being exploited in the wild.

How severe is CVE-2026-61653?

High severity, with a CVSS score of 8.3, published 5 November 2026.

Which products and versions are affected?

SuiteCRM prior to 7.15.2 and 8.10.2.

Is there a fix for CVE-2026-61653?

Yes: fixed in SuiteCRM 7.15.2, 8.10.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-61653 attacked?

It is attacked over the network.

Am I affected by CVE-2026-61653?

Check whether you run SuiteCRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-61653: SuiteCRM Campaigns SQL injection in PopupCampaignRoi

CVE-2026-61653 · Severity: high · CVSS 8.3 · Published 2026-11-05

SuiteCRM is an open-source CRM system used by enterprises to manage customer relationships and sales data. An authenticated attacker with Campaigns access can exploit a SQL injection vulnerability to extract or manipulate sensitive data from the database through time-based blind SQL injection attacks. This could lead to unauthorized access to customer information, financial data, or other confidential business information stored in the CRM.

Technologies: SuiteCRM. Vendors: SuiteCRM.

Quick answers

Is CVE-2026-61653 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-61653 being exploited in the wild.
How severe is CVE-2026-61653?: High severity, with a CVSS score of 8.3, published 5 November 2026.
Which products and versions are affected?: SuiteCRM prior to 7.15.2 and 8.10.2.
Is there a fix for CVE-2026-61653?: Yes: fixed in SuiteCRM 7.15.2, 8.10.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61653 attacked?: It is attacked over the network.
Am I affected by CVE-2026-61653?: Check whether you run SuiteCRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: SuiteCRM 7.15.2, 8.10.2

Technical details

The vulnerability exists in modules/Campaigns/PopupCampaignRoi.php where user input from $_REQUEST['id'] is interpolated directly into SQL queries. Although the securexss() function normally entity-encodes quotes, an XSS payload prefix causes AntiXSS to select a processed string that allows literal quotes to bypass encoding and reach the SQL query. An authenticated user with Campaigns module access can perform time-based blind SQL injection against arbitrary database tables.

Affected products

SuiteCRM SuiteCRM prior to 7.15.2 and 8.10.2

Timeline

2026-11-05: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.