Sugar Versions 9.0.3 and 8.0.6 Now Available

SugarCRM has released versions 9.0.3 and 8.0.6 for all editions and are available for download to on-site customers. At SugarCRM, we consider data security and the protection of your private information our highest priority. This latest release includes important security updates. As part of our ongoing security review process, we have recently detected security vulnerabilities and, to minimize potential risks, those issues have been investigated and addressed in this updated release.

For more information regarding the specific advisories, please refer to the following Security Advisory announcements:

• Security Advisory sugarcrm-sa-2020-001 : Authenticated users may cause arbitrary code to be executed
• Security Advisory sugarcrm-sa-2020-002 : Authenticated users may cause arbitrary code to be executed
• Security Advisory sugarcrm-sa-2020-003 : Authenticated users may cause arbitrary code to be executed
• Security Advisory sugarcrm-sa-2020-004 : Authenticated users may cause arbitrary code to be executed
• Security Advisory sugarcrm-sa-2020-005 : Authenticated users may cause arbitrary code to be executed
• Security Advisory sugarcrm-sa-2020-006 : Authenticated administrative users may cause arbitrary code to be executed
• Security Advisory sugarcrm-sa-2020-007 : Authenticated users may cause arbitrary code to be executed
• Security Advisory sugarcrm-sa-2020-008 : Authenticated administrative users may cause arbitrary code to be executed
• Security Advisory sugarcrm-sa-2020-009 : Authenticated users may cause arbitrary code to be executed
• Security Advisory sugarcrm-sa-2020-010 : Authenticated administrative users may cause arbitrary code to be executed
• Security Advisory sugarcrm-sa-2020-011 : Authenticated users may cause arbitrary code to be executed
• Security Advisory sugarcrm-sa-2020-012 : Authenticated users may cause arbitrary code to be executed
• Security Advisory sugarcrm-sa-2020-013 : Authenticated administrative users may cause arbitrary code to be executed
• Security Advisory sugarcrm-sa-2020-014 : Authenticated users may cause arbitrary code to be executed
• Security Advisory sugarcrm-sa-2020-015 : Authenticated users may cause arbitrary code to be executed
• Security Advisory sugarcrm-sa-2020-016 : Authenticated administrative users may cause arbitrary code to be executed
• Security Advisory sugarcrm-sa-2020-017 : Authenticated administrative users may cause arbitrary code to be executed
• Security Advisory sugarcrm-sa-2020-018 : Authenticated users may cause arbitrary code to be executed
• Security Advisory sugarcrm-sa-2020-019 : Authenticated administrative users may cause arbitrary code to be executed
• Security Advisory sugarcrm-sa-2020-020 : Authenticated users may cause arbitrary code to be executed
• Security Advisory sugarcrm-sa-2020-021 : Authenticated users may cause arbitrary code to be executed
• Security Advisory sugarcrm-sa-2020-022 : Authenticated administrative users may cause arbitrary code to be executed
• Security Advisory sugarcrm-sa-2020-023 : Authenticated users may cause arbitrary code to be executed

Following our investigations, we have no indication that the vulnerabilities were exploited. However, administrators are strongly encouraged to upgrade their Sugar instances running the 9.0.2 or 8.0.5 versions of Sugar or prior to 9.0.3 or 8.0.6 to prevent potential exploitation of these weaknesses.

If you host your instance on-site (in any environment outside of the SugarCloud environment), please carefully review the following instructions and take the actions outlined below at the earliest opportunity. Failure to take these actions could leave you exposed to malicious attacks. No action is needed for instances hosted on Sugar Cloud as these vulnerabilities have already been remedied per Sugar Cloud policy.

Please visit our Download Manager to download the latest patch for your release, 9.0.3 or 8.0.6, which address these vulnerabilities. Our Installation and Upgrade Guide contains the appropriate guidance to apply these patches to your instance.

If upgrading now is not an option, please open a case with our support team to request a hotfix for the security vulnerabilities. We will then supply a module loadable package that can be applied to your current version and edition of Sugar. Please note that we will only supply hotfixes for supported versions. Support tickets can be opened via our portal or by emailing support@sugarcrm.com. If you are not familiar with the support process, please review our knowledge base article on Working With Sugar Support.

Release Notes

More information on the updates in this release can be found at the following links:

• Ultimate 9.0.3 Release Notes / Ultimate 8.0.6 Release Notes
• Enterprise 9.0.3 Release Notes / Enterprise 8.0.6 Release Notes
• Professional 9.0.3 Release Notes / Professional 8.0.6 Release Notes