home / blog
2026-11-05 · critical
CVE-2026-71550: Remote Code Execution in SuiteCRM Workflow
CVSS 9.9 | RCE in SuiteCRM via path traversal in AOW_WorkFlow. Patch 7.15.2, 8.10.2 available.
CVE-2026-71550 is a path traversal vulnerability in the modules/AOW_WorkFlow/controller.php controller of SuiteCRM. The aow_action parameter is passed directly to require_once() without validation, allowing an authenticated user with WorkFlow role to include arbitrary PHP files and achieve remote code execution. It affects SuiteCRM versions prior to 7.15.2 and 8.10.2.
The CVSS score is 9.9 (critical). The vulnerability requires authentication and WorkFlow role, but enables access to CRM data, configuration secrets, and establishment of persistent access. The patch was released on 2026-11-05, the same day as the CVE publication. On X, 19 posts in the last 24 hours report content consistent with the official NVD description.
SuiteCRM administrators must prioritize updating to the patched versions (7.15.2 or 8.10.2). In the meantime, it is critical to review users assigned WorkFlow role, audit access logs to AOW_WorkFlow modules for suspicious activity, and test updates in staging before deploying to production.
At a glance
- What
- Path traversal in modules/AOW_WorkFlow/controller.php allows arbitrary PHP file inclusion via aow_action parameter in require_once(). CVE-2026-71550 affects SuiteCRM.
- Severity
- CVSS 9.9 (critical). Remote code execution, access to CRM data and configuration secrets, persistence possible.
- Affected versions
- SuiteCRM < 7.15.2 and < 8.10.2
- Fix
- Update to 7.15.2 or 8.10.2
- Status
- Patch available since 2026-11-05. No public exploits reported in dataset.
- Action
- Priority: verify users with WorkFlow role, audit AOW_WorkFlow controller access logs, update immediately.
Sources: NVD, CVE-2026-71550