CVE-2026-59994 espocrm CVE debrief

Who should care

Defenders responsible for EspoCRM installations, particularly those exposed to untrusted email sources, should assess their exposure and prioritize upgrading to version 9.3.9 or later.

Why it matters

CVE-2026-59994 is a pre-authentication stored HTML injection vulnerability in EspoCRM stream notification emails about received emails. Defenders should prioritize verifying exposure and upgrading to version 9.3.9 or later.

• Potential HTML injection and JavaScript execution in mail clients that support it
• Exposure of EspoCRM installations to untrusted email sources
• Need for verification of EspoCRM version and exposure
• Potential for suspicious email activity and user reports of rendered HTML in notification emails

Technical summary

The vulnerability allows an unauthenticated remote attacker to send an email with arbitrary HTML in its plain-text body to a monitored group or IMAP address. The HTML is stored and rendered without escaping in Email Received stream notification emails, potentially allowing HTML injection and JavaScript execution. This issue is fixed in EspoCRM version 9.3.9. Defenders should prioritize verifying exposure of EspoCRM installations to untrusted email sources and upgrading to version 9.3.9 or later. They should also monitor for suspicious email activity and user reports of rendered HTML in notification emails.

Defensive priority

Defenders should prioritize verifying exposure of EspoCRM installations to untrusted email sources and upgrading to version 9.3.9 or later. They should also monitor for suspicious email activity and user reports of rendered HTML in notification emails.

Recommended defensive actions

• Verify EspoCRM installations for exposure to untrusted email sources
• Upgrade to EspoCRM version 9.3.9 or later
• Monitor for suspicious email activity and user reports of rendered HTML in notification emails
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, its impact, and the fixed version. However, there is limited information on potential exploitation, victims, or business impact. Defenders should verify EspoCRM installations for exposure to untrusted email sources and monitor for suspicious email activity. The vulnerability allows an unauthenticated remote attacker to send an email with arbitrary HTML in its plain-text body to a monitored group or IMAP address. The HTML is stored and rendered without escaping in 'sp

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.