Read the docs
TI-2025-18706 Aliases CVE-2025-25034GHSA-wcx8-f39f-5c87

SugarCRM PHP Deserialization RCE

Priority HIGH 75CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-502.

Summary

A PHP object injection vulnerability exists in SugarCRM versions prior to 6.5.24, 6.7.13, 7.5.2.5, 7.6.2.2, and 7.7.1.0 due to improper validation of PHP serialized input in the SugarRestSerialize.php script. The vulnerable code fails to sanitize the rest_data parameter before passing it to the unserialize() function. This allows an unauthenticated attacker to submit crafted serialized data containing malicious object declarations, resulting in arbitrary code execution within the application context. Although SugarCRM released a prior fix in advisory sugarcrm-sa-2016-001, the patch was incomplete and failed to address some vectors. Exploitation evidence was observed by the Shadowserver Foundation on 2024-09-13 UTC.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.04963 92nd percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by the CNA
Fix Fixed SugarCRM (SugarCRM): 6.5.24, 6.7.13, 7.5.2.5 +2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SugarCRMSugarCRM6.5.0 to before 6.5.24; 6.7.0 to before 6.7.13; 7.5.0 to before 7.5.2.5; 7.6.0 to before 7.6.2.2; 7.7.0 to before 7.7.1.06.5.24, 6.7.13, 7.5.2.5, 7.6.2.2, 7.7.1.0Patch availableCNA
  • SugarCRM VendorSugarCRM Affected 6.5.0 to before 6.5.24; 6.7.0 to before 6.7.13; 7.5.0 to before 7.5.2.5; 7.6.0 to before 7.6.2.2; 7.7.0 to before 7.7.1.0 Fixed in 6.5.24, 6.7.13, 7.5.2.5, 7.6.2.2, 7.7.1.0 Patch available CNA

Remediation

  • Fix · CNA SugarCRM (SugarCRM) Fixed in 6.5.24, 6.7.13, 7.5.2.5, 7.6.2.2, 7.7.1.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-25034
  2. 2026-10-03 Alias added: GHSA-wcx8-f39f-5c87
  3. 2026-10-29 Fix available: SugarCRM/[email protected], SugarCRM/[email protected], SugarCRM/[email protected] +2 · CNA

References

Exploit 2

Advisory 3

Other 1

  • TI-2023-09083 In SugarCRM before 12.0. KEVCVSS 3.1HIGH 8.8
  • TI-2012-00639 SugarCRM CE <= 6.3.1 contains scripts that use "unserialize()" with user controlled input… CVSS 3.1CRITICAL 9.8
  • TI-2023-17895 An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. CVSS 3.1HIGH 8.8
  • TI-2023-17892 An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. CVSS 3.1HIGH 8.8
  • TI-2023-17894 An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. CVSS 3.1HIGH 7.2
  • TI-2024-38359 Code injection in SugarCRM CVSS 3.1HIGH 7.2
See all 69 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences