Quick answers
- Is CVE-2026-63111 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-63111 being exploited in the wild.
- How severe is CVE-2026-63111?
- Informational severity, published 5 November 2026.
- Which products and versions are affected?
- SuiteCRM prior to 7.15.2 and 8.10.2.
- Is there a fix for CVE-2026-63111?
- Yes: fixed in 7.15.2, 8.10.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-63111 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-63111?
- Check whether you run SuiteCRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 7.15.2, 8.10.2
Technical details
The V8 module API endpoint /Api/V8/module lacks module-level authorization checks, allowing low-privileged users to create SchedulersJobs records with attacker-controlled target values. The cron.php scheduler later executes these jobs with system privileges, and the url:: target handler can make server-side requests to internal or external hosts, follow redirects, and persist as recurring jobs. An attacker gains the ability to probe internal services, interact with restricted endpoints, and establish persistent automated attack footprints.
Affected products
- SuiteCRM SuiteCRM prior to 7.15.2 and 8.10.2
Timeline
- 2026-11-05: disclosed
- 2026-07-29: patched