Is CVE-2026-97377 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-97377 being exploited in the wild.

How severe is CVE-2026-97377?

High severity, with a CVSS score of 8.8, published 5 November 2026.

Which products and versions are affected?

SuiteCRM before 7.15.2 and 8.10.2.

Is there a fix for CVE-2026-97377?

Yes: fixed in SuiteCRM 7.15.2, 8.10.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-97377 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-97377?

Check whether you run SuiteCRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-97377: SuiteCRM SQL injection in SOAP portal API

CVE-2026-97377 · Severity: high · CVSS 8.8 · Published 2026-11-05

SuiteCRM is an open-source customer relationship management system used to manage sales and customer data. A vulnerability in its legacy SOAP portal API allows attackers with low-level portal access to inject malicious SQL commands, potentially exposing sensitive customer data and business records from the database. Exploitation requires valid portal API credentials but does not require special privileges within the system.

Technologies: SuiteCRM. Vendors: SuiteCRM.

Quick answers

Is CVE-2026-97377 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-97377 being exploited in the wild.
How severe is CVE-2026-97377?: High severity, with a CVSS score of 8.8, published 5 November 2026.
Which products and versions are affected?: SuiteCRM before 7.15.2 and 8.10.2.
Is there a fix for CVE-2026-97377?: Yes: fixed in SuiteCRM 7.15.2, 8.10.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-97377 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-97377?: Check whether you run SuiteCRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: SuiteCRM 7.15.2, 8.10.2

Technical details

The legacy SOAP portal method portal_get_entry_list fails to properly sanitize the where and order_by parameters before using them in SQL query construction, allowing blind SQL injection. An authenticated low-privileged portal API user can exploit this to extract database metadata and sensitive records, modify query behavior, and perform resource exhaustion attacks. The vulnerability is fixed in versions 7.15.2 and 8.10.2.

Affected products

SuiteCRM SuiteCRM before 7.15.2 and 8.10.2

Timeline

2026-11-05: disclosed
2026-07-29: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.