CVE-2026-51947: An issue in Pivotal CRM 6

Synopsis

Remote code execution via insecure deserialization in Pivotal CRM 6.6.4.08 and systems running patch-ghi-15381-cwe-502-20251225.zip. The vulnerability is reachable over the network with no authentication and no user interaction required, through the Pivotal.Engine.Client.Services.Conversion.dll component. Successful exploitation gives an attacker full remote code execution on the affected host. Note: this is an incomplete fix for CVE-2026-39253, meaning prior mitigations are insufficient. HarborGuard is tracking the advisory and will make a patched-image rebuild available the moment fix versions are published upstream.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable component is exposed over the network; an attacker must be able to reach it via a standard network connection.

• AuthenticationNot required

  No credentials or session token are needed; the attacker can target the service as an unauthenticated user.

• Victim interactionNot required

  No user action such as clicking a link or opening a file is needed to trigger the vulnerability.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions, memory layout knowledge, or special environmental state is required.

Blast Radius

• Attacker executes arbitrary operating system commands on the host running the Pivotal CRM service.
• All data accessible to the CRM process is readable, including stored customer records, credentials, and session tokens.
• Attacker can write, modify, or delete persisted data managed by the CRM, including database rows and configuration files.
• The affected service and dependent processes can be crashed or made permanently unavailable.