Timtimxs

An issue in Pivotal CRM 6.6.4.08 and systems using patch-ghi-15381-cwe-502-20251225.zip (fixed in Pivotal CRM 6.6.5.10 and Patch CWE502 20260316.zip) allows a remote attacker to execute arbitrary code via the Pivotal.Engine.Client.Services.Conversion.dll component. NOTE: this issue exists because of an incomplete fix for CVE-2026-39253.

**Name of the Vulnerable Software and Affected Versions** Pivotal CRM version 6.6.04.08 **Description** A remote attacker can execute arbitrary code through the `Pivotal.Core.Common.dll` and `Pivotal.Engine.Client.Services.Conversion.dll` components. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.