CVE-2026-33289

CVE-2026-33289 describes a critical LDAP Injection vulnerability in SuiteCRM, affecting versions prior to 7.15.1 and 8.9.3. This flaw, rated 9.8 CRITICAL, allows an unauthenticated attacker to manipulate LDAP queries by injecting control characters into unsanitized user input during the authentication process. The attack vector is network-based with low complexity, posing a significant risk. Successful exploitation can lead to authentication bypass, sensitive information disclosure, and potentially full system compromise. While there is currently no evidence of active exploitation, public exploit code, or significant community discussion, the high severity necessitates immediate patching.