CVE-2026-47168 | EspoCRM up to 9.3.6 MassAction/Export deserialization

October 15, 2026 Yanac

A vulnerability, which was classified as problematic, has been found in EspoCRM up to 9.3.6. This affects an unknown function. The manipulation of the argument MassAction/Export leads to deserialization.

This vulnerability is traded as CVE-2026-47168. It is possible to initiate the attack remotely. There is no exploit available.

It is advisable to upgrade the affected component.VulDB Recent EntriesRead More