An unauthenticated attacker can trigger remote code execution by sending specially crafted PHP serialized data into the rest_data parameter of SugarCRM's SugarRestSerialize.php. The application fails to sanitize serialized input before passing it to PHP's unserialize() function, leading to object injection that can execute arbitrary code in the context of the web server. The flaw is present in all SugarCRM releases older than 6.5.24, 6.7.13, 7.5.2.5, 7.6.2.2, and 7.7.1.0. Because the code runs with the web application privileges, an attacker who succeeds can gain full control of the compromised instance, including data exfiltration and persistence.

The vulnerability affects SugarCRM's enterprise edition. Affected releases include any version released before 6.5.24, 6.7.13, 7.5.2.5, 7.6.2.2, or 7.7.1.0. These versions were still enabled by default in many deployments, making the issue widely exploitable for organizations running legacy SugarCRM installations.

With a CVSS score of 9.3, the flaw is considered critical, and an EPSS score of 75 % indicates a high probability of exploitation at the time of analysis. The vulnerability has not yet been catalogued by CISA KEV, but Shadowserver confirmed exploitation in September 2024. The attack vector is a remote unauthenticated request to the REST endpoint, after which PHP unserialize() is invoked with the attacker‑supplied payload. Unless mitigated, the result is uncontrolled code execution in the application context.