Description
An issue in Pivotal CRM 6.6.4.08 and systems using patch-ghi-15381-cwe-502-20251225.zip (fixed in Pivotal CRM 6.6.5.10 and Patch_CWE502_20260316.zip) allows a remote attacker to execute arbitrary code via the Pivotal.Engine.Client.Services.Conversion.dll component. NOTE: this issue exists because of an incomplete fix for CVE-2026-39253.
Published: 2026-07-01
Score: 9.8 Critical
EPSS: 1.1% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is an insecure deserialization flaw in the Pivotal.Engine.Client.Services.Conversion.dll component from an incomplete fix of a previous CVE. A remote attacker can craft malicious payloads that are deserialized and executed as arbitrary code, a weakness classified as CWE-502.

Affected Systems

Pivotal CRM 6.6.4.08 and systems using patch-ghi-15381-cwe-502-20251225.zip that have not applied the fix remain vulnerable. The flaw is resolved in Pivotal CRM 6.6.5.10 and Patch_CWE502_20260316.zip.

Risk and Exploitability

The flaw is an insecure deserialization vulnerability in the Pivotal.Engine.Client.Services.Conversion.dll component that originates from an incomplete remediation of CVE-2026-39253. A remote attacker can send a crafted payload over the network to the Pivotal CRM application, which is then deserialized by the vulnerable component, resulting in arbitrary code execution on the host. The CVSS score of 9.8 highlights the severity of this issue, and the EPSS value of 1 % indicates a low but non‑zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, but the high CVSS score and the remote attack surface keep the overall risk elevated.

Generated by OpenCVE AI on July 17, 2026 at 02:15 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor-provided patch or upgrade to Pivotal CRM 6.6.5.10 and Patch_CWE502_20260316.zip, ensuring the Conversion.dll component is updated.
  • As a temporary measure, disable features that trigger the vulnerable deserialization or restrict the processing of untrusted data until the patch is applied.
  • Monitor network traffic and application logs for abnormal deserialization activity that could indicate an attempted exploitation.

Generated by OpenCVE AI on July 17, 2026 at 02:15 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 17 Jul 2026 02:45:00 +0000

Type Values Removed Values Added
Title Insecure Deserialization in Pivotal CRM Allows Remote Code Execution

Tue, 14 Jul 2026 19:45:00 +0000

Type Values Removed Values Added
Title Insecure Deserialization in Pivotal Engine Enables Remote Code Execution

Mon, 13 Jul 2026 16:00:00 +0000

Type Values Removed Values Added
Title Insecure Deserialization in Pivotal Engine Enables Remote Code Execution

Sun, 12 Jul 2026 10:15:00 +0000

Type Values Removed Values Added
Title Insecure Deserialization in Pivotal CRM 6.6.4.08 Enables Remote Code Execution

Sat, 11 Jul 2026 09:00:00 +0000

Type Values Removed Values Added
Title Insecure Deserialization in Pivotal CRM 6.6.4.08 Enables Remote Code Execution

Fri, 10 Jul 2026 17:30:00 +0000

Type Values Removed Values Added
Title Insecure Deserialization in Pivotal CRM 6.6.4.08 Allows Remote Code Execution

Thu, 09 Jul 2026 21:00:00 +0000

Type Values Removed Values Added
Title Insecure Deserialization in Pivotal CRM 6.6.4.08 Allows Remote Code Execution

Thu, 09 Jul 2026 07:30:00 +0000

Type Values Removed Values Added
Title Insecure Deserialization Enables Remote Code Execution in Pivotal CRM 6.6.4.08

Wed, 08 Jul 2026 14:15:00 +0000

Type Values Removed Values Added
Title Insecure Deserialization Enables Remote Code Execution in Pivotal CRM 6.6.4.08

Tue, 07 Jul 2026 21:15:00 +0000

Type Values Removed Values Added
Title Insecure Deserialization in Pivotal CRM Allows Remote Code Execution

Mon, 06 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
Title Insecure Deserialization in Pivotal CRM Allows Remote Code Execution

Sun, 05 Jul 2026 11:30:00 +0000

Type Values Removed Values Added
Title Insecure Deserialization Enabling Remote Code Execution in Pivotal CRM

Sun, 05 Jul 2026 03:30:00 +0000

Type Values Removed Values Added
Title Insecure Deserialization Enabling Remote Code Execution in Pivotal CRM

Sat, 04 Jul 2026 07:15:00 +0000

Type Values Removed Values Added
Title Insecure Deserialization Vulnerability in Pivotal CRM Allows Remote Code Execution

Fri, 03 Jul 2026 16:15:00 +0000

Type Values Removed Values Added
Title Insecure Deserialization Vulnerability in Pivotal CRM Allows Remote Code Execution

Fri, 03 Jul 2026 05:00:00 +0000

Type Values Removed Values Added
Title Insecure Deserialization in Pivotal Engine Client Conversion Component

Thu, 02 Jul 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 02 Jul 2026 16:45:00 +0000

Type Values Removed Values Added
Title Insecure Deserialization in Pivotal Engine Client Conversion Component
Weaknesses CWE-502

Thu, 02 Jul 2026 06:15:00 +0000

Type Values Removed Values Added
Title Remote Code Execution via Insecure Deserialization in Pivotal CRM 6.6.4.08
Weaknesses CWE-502

Thu, 02 Jul 2026 04:30:00 +0000

Type Values Removed Values Added
First Time appeared Pivotal
Pivotal crm
Vendors & Products Pivotal
Pivotal crm

Thu, 02 Jul 2026 00:00:00 +0000

Type Values Removed Values Added
Title Remote Code Execution via Insecure Deserialization in Pivotal CRM 6.6.4.08
Weaknesses CWE-502

Wed, 01 Jul 2026 19:15:00 +0000

Type Values Removed Values Added
Description An issue in Pivotal CRM 6.6.4.08 and systems using patch-ghi-15381-cwe-502-20251225.zip (fixed in Pivotal CRM 6.6.5.10 and Patch_CWE502_20260316.zip) allows a remote attacker to execute arbitrary code via the Pivotal.Engine.Client.Services.Conversion.dll component. NOTE: this issue exists because of an incomplete fix for CVE-2026-39253.
References

Subscriptions

Pivotal Crm
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-07-02T16:57:04.583Z

Reserved: 2026-06-08T00:00:00.000Z

Link: CVE-2026-51947

cve-icon Vulnrichment

Updated: 2026-07-02T16:51:53.309Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-17T02:30:08Z

Weaknesses
  • CWE-502

    Deserialization of Untrusted Data