CVE-2026-51947CRITICALCVSS 9.8

CVE-2026-51947

Published Jul 1, 2026·Updated Jul 2, 2026

Description

An issue in Pivotal CRM 6.6.4.08 and systems using patch-ghi-15381-cwe-502-20251225.zip (fixed in Pivotal CRM 6.6.5.10 and Patch_CWE502_20260316.zip) allows a remote attacker to execute arbitrary code via the Pivotal.Engine.Client.Services.Conversion.dll component. NOTE: this issue exists because of an incomplete fix for CVE-2026-39253.

Public Exploits & PoCs1 found

[POC] CVE-2026-51947 — CVE-2026-51947-Advisory

Pivotal CRM's patch for an initial deserialization vulnerability was incomplete. The fix switched from BinaryFormatter to JSON.NET but left TypeNameHandling set to 4 without implementing SerializationBinder, allowing attackers to execute arbitrary code through malicious $type payloads. Fixed in 6.6.5.10 and Patch_CWE502_20260316.zip

References

View on NVD Search GitHub Search Google

Get alerted for CVEs like this

Start monitoring free