CVE advisoryCRITICAL
CVE-2025-25034
SugarCRM PHP Object Injection Arbitrary Code Execution
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A PHP object injection vulnerability in SugarCRM allows unauthenticated attackers to execute arbitrary code by sending crafted serialized data to the application's REST API. Although a prior patch was released, it was incomplete, and exploitation has been observed.