EspoCRM: Authenticated RCE via unsafe PHP object deserialization
Summary
EspoCRM versions before 9.3.7 deserialize crafted PHP object data stored in background MassAction and Export parameters without restricting allowed classes. An authenticated administrator can use this to instantiate arbitrary objects and execute code on the server. The NVD rates the issue CVSS 9.1 (Critical) with a changed scope, but the attacker must already hold administrator rights.
Affected
- EspoCRM versions before 9.3.7
- Self-hosted installations, including Docker and Cloudron installs
Fixed in
- Upgrade to EspoCRM 9.3.7 or later (the releases page lists 9.3.8 as newer; the current 9.3.x release has not been verified)
Workaround
- No vendor workaround documented. Unknown whether one was published.
Exploitation
- Not listed in CISA KEV.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- No public exploit or in-the-wild reports found so far; EPSS about 0.004.
Our recommendation
- Inventory all EspoCRM instances, including Docker and Cloudron installs, and record their versions.
- Upgrade every instance below 9.3.7 to the current 9.3.x release.
- Until patched, limit the number of admin accounts, enforce MFA for admins and restrict admin access to VPN or trusted IPs.
- Review recent background MassAction and Export activity for anomalies.
- Check whether any instance is reachable from the internet.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-7q78-jjr9-mqcg github.com
- EspoCRM release 9.3.7 github.com
- Fix commit f48d1d2 github.com
- OpenCVE CVE-2026-47168 app.opencve.io
- Strix CVE-2026-47168 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 06:32.
Original description (NVD)
EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated administrator can supply crafted serialized PHP object data that is stored in background MassAction or Export parameters and later deserialized by the application. The deserialization paths do not restrict allowed classes, allowing attacker-controlled object instantiation and arbitrary code execution on the server. This issue is fixed in version 9.3.7.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.