CVE-2026-39253

Insecure Deserialization Allows Remote Code Execution in Pivotal CRM 6.6.04.08

View on CVE.org
Published Jun 23, 2026 CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Description
An issue in Pivotal CRM v.6.6.04.08 allows a remote attacker to execute arbitrary code via the Pivotal.Core.Common.dll and Pivotal.Engine.Client.Services.Conversion.dll components.

Analysis

AI-generated

Technical impact

A flaw in Pivotal CRM 6.6.04.08 allows a remote attacker to execute arbitrary code by exploiting the vulnerable Pivotal.Core.Common.dll and Pivotal.Engine.Client.Services.Conversion.dll components. The vulnerability reflects an insecure deserialization weakness (CWE‑502) that permits crafted data to trigger arbitrary code execution on the host system.

Affected Systems

Pivotal CRM version 6.6.04.08 is affected. No other versions are currently known to be impacted.

Risk and Exploitability

The CVSS score of 8.1 indicates a high severity vulnerability. EPSS information is not available, and the flaw is not listed in the CISA KEV catalog, suggesting limited active exploitation. Nevertheless, the remote code execution capability poses a significant risk; a remote attacker who can send crafted inputs can gain full control over the application host, compromising confidentiality, integrity, and availability. The likely attack vector is remote data input triggering insecure deserialization of untrusted data.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor‑provided patch that updates the Pivotal.Core.Common.dll and Pivotal.Engine.Client.Services.Conversion.dll components as documented in the support article.
  • Upgrade to a newer release of Pivotal CRM that includes the fixed DLLs.
  • Disable or restrict deserialization of untrusted data by configuring application settings or applying runtime filters and enforce strict input validation to ensure only trusted data is processed.

Generated by OpenCVE AI on June 24, 2026 at 09:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Pivotal
Pivotal crm
Vendors & Products Pivotal
Pivotal crm
Type Values Removed Values Added
Title Insecure Deserialization Allows Remote Code Execution in Pivotal CRM 6.6.04.08
Type Values Removed Values Added
Title Insecure deserialization in Pivotal CRM 6.6.04.08 enables remote code execution
Type Values Removed Values Added
Title Insecure deserialization in Pivotal CRM 6.6.04.08 enables remote code execution
Type Values Removed Values Added
Title Remote Code Execution via Vulnerable DLLs in Pivotal CRM 6.6.04.08
Type Values Removed Values Added
Title Remote Code Execution via Vulnerable DLLs in Pivotal CRM 6.6.04.08
Type Values Removed Values Added
Weaknesses CWE-502
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description An issue in Pivotal CRM v.6.6.04.08 allows a remote attacker to execute arbitrary code via the Pivotal.Core.Common.dll and Pivotal.Engine.Client.Services.Conversion.dll components.
References
Earlier changes (3)
Weaknesses
  • CWE-502

    Deserialization of Untrusted Data

Sources

Status
PUBLISHED
Assigner
mitre
Published
Updated
Jun 23, 2026, 8:42 PM
Reserved
Apr 6, 2026, 12:00 AM

View source JSON

Updated
Jun 23, 2026, 8:38 PM

JSON

Status
Deferred
Published
Jun 23, 2026, 8:16 PM
Modified
Oct 25, 2026, 11:10 PM

View source JSON

No data.

Updated
Jun 24, 2026, 4:06 PM

JSON