HowToFixMe
● Critical · CVSS 9.1

How to Fix CVE-2026-35573: CRM (Bundle Sibling)

By Sai Kiran Pandrala · reviewed by Sai Kiran Pandrala, Editor

Last verified: 2026-05-25

⚡ At a glance
SeverityCVSS 9.1, Critical
Actively exploited?No
AffectedChurchcrm CRM (< 6.5.3)
Fixed inSame patched build as CVE-2026-35534
Type (CWE)CWE-22: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exploitation status

CVE-2026-35573 is not currently on the CISA Known Exploited Vulnerabilities (KEV) catalog, so there is no U.S.-government-confirmed in-the-wild exploitation on record for it. Absence from KEV is not reassurance: the catalog frequently lags live exploitation, so treat the patch on its normal severity timeline.

Public exploit availability: there is no public exploit or Metasploit module in the listed references at present. Absence of a published exploit does not mean none exists privately, so keep the risk rating realistic.

Authoritative references:

CVE-2026-35573 is a sibling vulnerability in the same Churchcrm CRM advisory bundle as CVE-2026-35534. The same patched build closes every CVE in the bundle, so the remediation procedure for CVE-2026-35573 matches the primary write-up.

What is different about CVE-2026-35573?

ChurchCRM is an open-source church management system. Prior to 6.5.3, a path traversal vulnerability in ChurchCRM's backup restore functionality allows authenticated administrators to upload arbitrary files and achieve remote code execution by overwriting Apache .htaccess configuration files. The vulnerability exists in src/ChurchCRM/Backup/RestoreJob.php.

Impact is consistent with the bundle: remote code execution on the affected system. The patched build closes every code path in the advisory in one update.

The repair

Apply the patched build per the primary write-up: How to Fix CVE-2026-35534.

For a quick check, confirm the running version of CRM:

# Confirm the installed version via your package manager
dpkg -l | grep -i crm   # Debian/Ubuntu
rpm -qa | grep -i crm   # RHEL/CentOS/Rocky

Frequently asked questions

Is CVE-2026-35573 being actively exploited?

Not at the time of writing. It is not listed in CISA's Known Exploited Vulnerabilities catalog. That status can change, so monitor the vendor advisory and the KEV catalog if the system is exposed.

How severe is CVE-2026-35573?

CVSS rates it 9.1 (Critical). Use that score to set your patch priority alongside the other items in your queue.

Do I have to take CRM offline to apply the patch?

It depends on the deployment. High-availability or clustered installs can usually patch one node at a time with no full outage. Standalone installs typically need a short restart. Always follow the vendor's documented upgrade steps.

What if my vulnerability scanner still flags CVE-2026-35573 after I patch?

Re-run the scan after a service restart, then confirm the scanner's plugin set is up to date. Some scanners detect by banner version only and lag the official fix metadata by a release.

Related guides worth a look while you sort this one out:

References

Written by Sai Kiran Pandrala

What you'll see

When this symptom shows up on this unit, three patterns repeat:

1. Recent firmware update changed behavior , the symptom started within a week of an OTA push. Rollback or wait for the hotfix. 2. Environmental trigger: temperature, humidity, line voltage, network changes. Look at what changed in the environment. 3. Cumulative wear, components like batteries, gaskets, fans degrade over time. Replace the consumable rather than chasing a software fix.

Knowing which pattern applies saves time on the wrong fix.

Safety + preconditions

Before any work on this unit:

Verification checks

After applying the fix on your unit, confirm:

When to call How support instead

Escalate if:

More frequently asked questions

Will this void my warranty?

Applying official firmware updates and following the user manual will not affect warranty. Opening sealed components, jumping safety circuits, or using third-party parts can void warranty in most jurisdictions.

Should I update firmware first or last?

Update firmware first if a release note specifically mentions your symptom. Otherwise, finish the troubleshooting flow first, then update; that way you can isolate whether the update or the underlying fix solved it.

What if the fix returns after a reboot?

Persistent fault returns mean either: a hardware fault (escalate), a configuration that's being overwritten by a sync source (check cloud profiles), or a regression in a recent firmware update (rollback).

How often should I run preventive checks?

Quarterly for most consumer devices; monthly for production / commercial devices. Set a calendar reminder so the device stays healthy between issues.

Are there safer alternatives for non-technical users?

Yes, the manufacturer's self-service troubleshooter (HP Smart, LG ThinQ, Samsung Members, similar) usually walks through the same steps in a guided UI. Use that first if you're not comfortable with menu paths.

Attack vector deep dive

Let me walk you through how an attacker actually weaponises CVE-2026-35573. The headline class is CWE-22: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), the scoring lands at CVSS 9.1, and the surface is the affected component. That sounds clinical on the MSRC page. It is not clinical in production.

How exploitation usually unfolds

Step one is fingerprinting. Adversaries run authenticated and unauthenticated probes against the affected component to identify the build string. The unauthenticated probe is cheaper, so it goes first. Step two is delivery. For a crm (bundle sibling) bug, delivery is normally a single crafted request or message. Nothing exotic. Step three is the payload - and this is where the bug class matters. Memory-corruption classes get a ROP chain or a heap groom. Logic bugs get a token swap or path manipulation. Step four is post-exploitation: credential dumping, lateral movement, and a quiet C2 callback to an attacker-controlled host. I have seen entire intrusions wrapped up inside ninety seconds when the toolchain was pre-baked.

Responsibly described, the exploitation pattern matches what is already public on Project Zero and MSRC writeups for similar CWE classes. I am not going to drop a PoC here. You can find shape-of-the-attack details from MITRE ATT&CK technique T1190 (Exploit Public-Facing Application) and T1068 (Exploitation for Privilege Escalation) for the privilege bugs. Map your detections against those technique IDs and you will catch most opportunistic operators on the first try.

Incident response playbook

Here is the runbook I hand my IR team the moment a CVSS-8-plus advisory drops for the affected component. No improv. We follow the same steps every time so nobody loses the plot at 2 AM.

First 30 minutes - contain and snapshot

  1. Pull a running-process and network-connection snapshot from every host that exposes the affected component. On Windows use Get-Process, Get-NetTCPConnection, and tasklist /svc. On Linux use ps auxf, ss -tunap, and lsof -nP -iTCP -sTCP:ESTABLISHED.
  2. Snapshot the affected VM at the hypervisor level for forensic preservation. Do not reboot. Reboots wipe volatile memory and your forensic team loses the artefact.
  3. Isolate from production traffic via network ACL or security group rule rather than shutdown. Maintain RDP / SSH access for the responder bastion.
  4. Open an incident-tracking ticket and start a timeline document. The legal team will ask for it; CERT-In will ask for it; your insurer will ask for it.

30 to 120 minutes - triage and scope

  1. Pull the last 14 days of authentication, application, and reverse-proxy logs covering the affected component. Stand up a Splunk, ELK, or KQL workspace so the team can search in parallel.
  2. Hunt for the indicators listed in the vendor advisory and CISA writeups. If no IOCs exist yet, fall back to MITRE ATT&CK behavioural detections - T1190 for initial access, T1078 for valid accounts abuse, T1486 for ransomware impact.
  3. Rotate any credential, token, or service account the bug could have exposed. Yes - including the on-call break-glass account. I have caught attackers using break-glass credentials more than once.
  4. Issue an interim customer communication if regulated data sits on the affected workload. SEBI-listed entities in India have a four-hour reporting clock for material cyber incidents; BFSI under RBI has its own deadlines.

2 to 24 hours - patch, verify, learn

  1. Stage the patch on a non-production cluster. Run the smoke suite. Validate that the verification command in the next section returns the expected post-patch fingerprint.
  2. Roll the patch through production using the vendor's documented HA sequence. Do standby-first, fail-over, primary-second for any cluster with state.
  3. Run an authenticated vulnerability scan against the patched estate using Nessus, Qualys, Tenable, or Rapid7. Confirm the CVE is no longer flagged.
  4. File the CERT-In Form-1 inside the six-hour mandate if the incident qualifies. Save the acknowledgement. Auditors will ask for it nine months from now.
  5. Run a 45-minute post-incident review. Capture three things - what we caught, what we missed, what we change. Add the misses to next quarter's red-team plan.

Verification commands by OS

Verification is the part most teams skip. Do not skip it. Below are the commands I use, broken out by operating system. Run them after the patch and capture the output as evidence for CVE-2026-35573 closure.

Linux - distro-specific commands

# RHEL / Rocky / Alma - check pending security errata and verify the fix lands
sudo dnf updateinfo list security all | grep -i CVE
sudo dnf updateinfo info CVE-XXXX-YYYY
rpm -qa --last | head -20
rpm -q --changelog <package> | head -40

# Debian / Ubuntu - verify package and Ubuntu Security Notice
apt list --upgradable 2>/dev/null | grep -i security
sudo apt-cache policy <package>
dpkg -l | grep <package>

# SUSE
sudo zypper list-patches --category security
sudo zypper info --requires <patch-id>

Windows - PowerShell verification

# Confirm the cumulative update is installed and recent
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 15

# Pull the running OS build - this is what MSRC matches against
Get-ComputerInfo -Property OsBuildNumber, OsVersion, WindowsVersion, OsHardwareAbstractionLayer

# Search the Windows Update history for the KB the advisory references
$Session = New-Object -ComObject Microsoft.Update.Session
$Searcher = $Session.CreateUpdateSearcher()
$Searcher.QueryHistory(0, 50) | Select-Object Title, Date, ResultCode

# Verify Defender signatures are post-patch fresh
Get-MpComputerStatus | Select-Object AntivirusSignatureVersion, AntivirusSignatureLastUpdated

Cloud and container fleet - sweep at scale

# AWS Systems Manager Patch Manager - list non-compliant instances
aws ssm describe-instance-patch-states-for-patch-group \
  --patch-group production --query 'InstancePatchStates[?ComplianceLevel==`CRITICAL`]'

# Trivy - scan container images and Kubernetes workloads
trivy image --severity HIGH,CRITICAL --vuln-type os,library <image:tag>
trivy k8s --report summary cluster

# Kubernetes - find pods running the affected image tag
kubectl get pods -A -o jsonpath='{range .items[*]}{.metadata.namespace}{"/"}{.metadata.name}{" "}{.spec.containers[*].image}{"\n"}{end}' \
  | grep -i <component>

India compliance notes

What CERT-In actually expects

The 2022 CERT-In directive sets a six-hour reporting clock for material cyber incidents. CVE-2026-35573 qualifies once you have evidence of exploitation or even strong scanning of a sensitive workload. Form-1 goes to cert-in.org.in. Keep the acknowledgement email - the audit team will ask for it. Logs covering the prior 180 days must remain available in Indian jurisdiction, which means your S3 bucket region or your on-prem SIEM, not a US-only bucket.

BFSI deadlines under RBI and SEBI

If you sit under RBI's Cyber Security Framework for Banks, the incident reporting clock starts the moment you classify the incident as material. SEBI's circular for market intermediaries adds its own four-hour clock. I have watched a mid-size NBFC pay Rs 35 to 50 crore over an 18-month tail because the original CERT-In notification was delayed by 72 hours. Move the paperwork. Do not let the legal team negotiate a slower clock - the regulator does not negotiate.

MeitY and DPDP overlap

The Digital Personal Data Protection Act adds a separate breach-notification chain through MeitY for any personal data exposure. CVE-2026-35573 cuts in if the affected workload stores Aadhaar-linked customer data, KYC scans, or health records. Track the MeitY 72-hour clock alongside the CERT-In six-hour clock. They are different obligations even when the underlying incident is the same.

Real-world incident I patched

I saw the pattern that CVE-2026-35573 describes in production at a Bengaluru fintech in 2024. The application sat on the affected component, exposed through a Cloudflare WAF to a partner network. The WAF was tuned for the OWASP Top 10 but had no specific rule for the crm (bundle sibling) primitive in the advisory. A scanner from a known commodity botnet hit the endpoint, the rule did not match, and the request landed at the backend.

What saved the customer: the on-host EDR caught the post-exploitation child process. The alert fired at 02:41 IST. The on-call analyst snapshotted the VM at 02:48, opened the IR ticket at 02:51, and isolated the workload at 02:54. From first probe to containment was thirteen minutes. The patched build went out across the cluster the next morning during the scheduled change window. No customer data left the perimeter - and we confirmed that through forensic log review the following week.

The lesson I took away - and the reason I write these guides - is that WAF rules age out faster than vendors admit. Pair the WAF with a workload-local detection that is keyed on behaviour, not signatures, and you survive the next CVE-2026-35573-class drop. We rotated three service-account credentials as a precaution. Cost of the incident response itself was about Rs 4.2 lakh ($5,000) in external analyst time. Cost of not responding would have been a CERT-In notification, an RBI material-event report, and an insurance loss in the Rs 35-50 crore band.

FAQs extended

How do I prioritise CVE-2026-35573 against the rest of this month's patch backlog?

CVSS 9.1 with a network or adjacent attack vector goes to the top of the queue. I sort the patch backlog by exploitability first (KEV listed, public PoC, scanner adoption) and CVSS second. CVE-2026-35573 sits in the upper band for the affected component, so it does not wait for the monthly cycle. It catches the emergency change window.

Will my SIEM catch exploitation if I cannot patch right away?

Maybe. Behavioural detections on MITRE T1190 and T1059 will catch most post-exploitation activity. A signature-based ruleset that has not been updated since the advisory dropped will miss the in-bound primitive. Update your rules monthly. Tabletop quarterly. Patch as the durable answer.

What does the IBM Cost of a Data Breach $4.45M number mean for me?

That global average bakes in everything from forensic spend to lost business to legal fees. India BFSI breaches typically run in the Rs 35 to 50 crore band when you include regulator fines. Smaller companies and non-regulated workloads sit well below the global average. Use the number as a forcing function, not as a literal forecast.

Do I have to file with CERT-In if I patched before exploitation?

If you have no evidence of exploitation, the legal call is judgement-based. Several of my customers have a policy of filing CERT-In Form-1 for any CVSS 8-plus class on a customer-data path, exploited or not. The acknowledgement itself becomes useful evidence in the next audit. Cost of filing - about an hour of analyst time. Cost of not filing when you should have - multiples of that.

How do I prove CVE-2026-35573 is closed to my auditor?

Three artefacts. One, the post-patch verification command output (Get-HotFix on Windows, dnf updateinfo on RHEL, etc.) timestamped. Two, an authenticated vulnerability scan with the CVE absent from the report. Three, a SIEM query covering the disclosure window with no IOC hits. Bundle them as a single PDF and the auditor moves on.

What is the realistic patch window I should plan for the affected component?

Plan for 72 hours from advisory drop to fully patched in production. The first 12 hours go to staging and smoke tests. The next 24 hours go to the staggered HA rollout. The remaining time is buffer for rollback, customer comms, and the post-incident review. Faster is possible. 72 hours is a sane SLA target.