How to Fix CVE-2026-35575: CRM (Bundle Sibling)

By Sai Kiran Pandrala · reviewed by Sai Kiran Pandrala, Editor

Last verified: 2026-05-25

CVE-2026-35575 is a sibling vulnerability in the same Churchcrm CRM advisory bundle as CVE-2026-35534. The same patched build closes every CVE in the bundle, so the remediation procedure for CVE-2026-35575 matches the primary write-up.

What is different about CVE-2026-35575?

ChurchCRM is an open-source church management system. Prior to 6.5.3, a Stored Cross-Site Scripting (Stored XSS) vulnerability in the admin panel’s group-creation feature allows any user with group-creation privileges to inject malicious JavaScript that executes automatically when an administrator views the page. This enables attackers to steal the administrator’s session cookies, potentially leading to full administrative account takeover.

Impact is consistent with the bundle: execution of attacker-controlled JavaScript in a victim's browser. The patched build closes every code path in the advisory in one update.

Resolve

Apply the patched build per the primary write-up: How to Fix CVE-2026-35534.

For a quick check, confirm the running version of CRM:

# Confirm the installed version via your package manager
dpkg -l | grep -i crm   # Debian/Ubuntu
rpm -qa | grep -i crm   # RHEL/CentOS/Rocky

Frequently asked questions

Is CVE-2026-35575 being actively exploited?

Not at the time of writing. It is not listed in CISA's Known Exploited Vulnerabilities catalog. That status can change, so monitor the vendor advisory and the KEV catalog if the system is exposed.

How severe is CVE-2026-35575?

CVSS rates it 8 (High). Use that score to set your patch priority alongside the other items in your queue.

Do I have to take CRM offline to apply the patch?

It depends on the deployment. High-availability or clustered installs can usually patch one node at a time with no full outage. Standalone installs typically need a short restart. Always follow the vendor's documented upgrade steps.

What if my vulnerability scanner still flags CVE-2026-35575 after I patch?

Re-run the scan after a service restart, then confirm the scanner's plugin set is up to date. Some scanners detect by banner version only and lag the official fix metadata by a release.

Related fixes

Related guides worth a look while you sort this one out:

• How to Fix CVE-2026-3557: CWE-122: Heap-based Buffer Overflow in Hue Bridge
• How to Fix CVE-2026-35570: Path traversal in openclaude
• How to Fix CVE-2026-35571: Emissary has Stored XSS via Navigation Template Link Injection
• How to Fix CVE-2026-35572: CRM (Bundle Sibling)
• How to Fix CVE-2026-35573: CRM (Bundle Sibling)
• How to Fix CVE-2026-35574: CRM (Bundle Sibling)

References

• Official vendor advisory: https://github.com/ChurchCRM/CRM/security/advisories/GHSA-gc8q-2gw7-qj7w
• NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2026-35575
• CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Primary write-up: How to Fix CVE-2026-35534

Written by Sai Kiran Pandrala

What changed recently?

Fault diagnosis on this unit goes faster when you map the symptom to a recent change:

• Did firmware update in the last 7 days?
• Did the network (router, ISP, VPN) change?
• Was the device moved physically?
• Did paired devices (phone, hub, app) update?
• Were any accessories swapped in or out?

The answer narrows the root cause to a manageable subset.

Safety + preconditions

Before any work on this unit:

• Unplug from mains for any internal-access procedure.
• Discharge stored energy (capacitors in PSUs, residual battery charge) per manufacturer guidance.
• Use ESD-safe handling for boards and modules , no carpet, no wool sleeves.
• Avoid moisture; never apply liquids near vents or connectors.
• If you smell smoke, see scorch marks, or feel uneven heat, stop and escalate.

Validate

Before you walk away from this device fix, run through:

1. Reproduce the original trigger: does the issue reappear? 2. Check the device's status / health screen for any new alerts. 3. Confirm paired devices (app, hub, controller) reconnected. 4. Save / commit any configuration changes per the device's normal workflow. 5. Note the change in your maintenance log with date + firmware version.

When to call How support instead

Escalate if:

• The same symptom returns within 24 hours of a clean fix.
• You see physical damage (burn marks, swollen battery, cracked PCB).
• The device is in warranty and a hardware replacement is the cheaper outcome.
• Repair requires specialised tools you don't own (alignment jigs, calibration software).
• Following the official path keeps the warranty intact, which matters more than the time spent.

More frequently asked questions

What if the fix returns after a reboot?

Persistent fault returns mean either: a hardware fault (escalate), a configuration that's being overwritten by a sync source (check cloud profiles), or a regression in a recent firmware update (rollback).

How often should I run preventive checks?

Quarterly for most consumer devices; monthly for production / commercial devices. Set a calendar reminder so the device stays healthy between issues.

Are there safer alternatives for non-technical users?

Yes, the manufacturer's self-service troubleshooter (HP Smart, LG ThinQ, Samsung Members, similar) usually walks through the same steps in a guided UI. Use that first if you're not comfortable with menu paths.

What if my model isn't exactly the same revision?

Cross-check the model code on the rating plate against the manufacturer support page. Major firmware generations sometimes shift the menu path; the option is usually under a similarly-named section.

Will the procedure work on the international variant?

Some features and firmware paths are region-locked. Check the model spec sheet to confirm your variant supports the menu option referenced. If you're outside the US/EU, look for the regional support portal.

Attack vector deep dive

Here is how I brief my SOC on CVE-2026-35575. CVSS 8. Bug class CWE-79: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Reachable surface is the affected component. From there the question is not can it be exploited. It is who will bother. Spoiler - for anything above CVSS 8, somebody will bother.

What a real exploit chain looks like

I have spent enough late nights inside compromised networks to recognise the pattern. An attacker chains CVE-2026-35575 with a credential-theft technique or a trust-relationship pivot. The crm (bundle sibling) surface in the affected component is the door. Once they are through, the playbook is the same boring sequence - dump LSASS or equivalent, harvest tokens, hop to a privileged workload, stage a beacon, exfiltrate.

Public reporting on similar CWE-79: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') bugs gives you a fair preview of timeline. From first probe to data exfil, expect a window of two to six hours for a competent operator, and under thirty minutes for one running a pre-built loader. Build your incident-response SLA against that window, not against the optimistic vendor timeline.

Incident response playbook

Treat CVE-2026-35575 as an active-incident drill even if you have no alerts yet. The first 60 minutes set the tone for the next 60 days of compliance paperwork. Run the steps in order. Do not skip the timeline doc.

First 30 minutes - contain and snapshot

1. Pull a running-process and network-connection snapshot from every host that exposes the affected component. On Windows use Get-Process, Get-NetTCPConnection, and tasklist /svc. On Linux use ps auxf, ss -tunap, and lsof -nP -iTCP -sTCP:ESTABLISHED.
2. Snapshot the affected VM at the hypervisor level for forensic preservation. Do not reboot. Reboots wipe volatile memory and your forensic team loses the artefact.
3. Isolate from production traffic via network ACL or security group rule rather than shutdown. Maintain RDP / SSH access for the responder bastion.
4. Open an incident-tracking ticket and start a timeline document. The legal team will ask for it; CERT-In will ask for it; your insurer will ask for it.

30 to 120 minutes - triage and scope

1. Pull the last 14 days of authentication, application, and reverse-proxy logs covering the affected component. Stand up a Splunk, ELK, or KQL workspace so the team can search in parallel.
2. Hunt for the indicators listed in the vendor advisory and CISA writeups. If no IOCs exist yet, fall back to MITRE ATT&CK behavioural detections - T1190 for initial access, T1078 for valid accounts abuse, T1486 for ransomware impact.
3. Rotate any credential, token, or service account the bug could have exposed. Yes - including the on-call break-glass account. I have caught attackers using break-glass credentials more than once.
4. Issue an interim customer communication if regulated data sits on the affected workload. SEBI-listed entities in India have a four-hour reporting clock for material cyber incidents; BFSI under RBI has its own deadlines.

2 to 24 hours - patch, verify, learn

1. Stage the patch on a non-production cluster. Run the smoke suite. Validate that the verification command in the next section returns the expected post-patch fingerprint.
2. Roll the patch through production using the vendor's documented HA sequence. Do standby-first, fail-over, primary-second for any cluster with state.
3. Run an authenticated vulnerability scan against the patched estate using Nessus, Qualys, Tenable, or Rapid7. Confirm the CVE is no longer flagged.
4. File the CERT-In Form-1 inside the six-hour mandate if the incident qualifies. Save the acknowledgement. Auditors will ask for it nine months from now.
5. Run a 45-minute post-incident review. Capture three things - what we caught, what we missed, what we change. Add the misses to next quarter's red-team plan.

Verification commands by OS

Verification is the part most teams skip. Do not skip it. Below are the commands I use, broken out by operating system. Run them after the patch and capture the output as evidence for CVE-2026-35575 closure.

Linux - distro-specific commands

# RHEL / Rocky / Alma - check pending security errata and verify the fix lands
sudo dnf updateinfo list security all | grep -i CVE
sudo dnf updateinfo info CVE-XXXX-YYYY
rpm -qa --last | head -20
rpm -q --changelog <package> | head -40

# Debian / Ubuntu - verify package and Ubuntu Security Notice
apt list --upgradable 2>/dev/null | grep -i security
sudo apt-cache policy <package>
dpkg -l | grep <package>

# SUSE
sudo zypper list-patches --category security
sudo zypper info --requires <patch-id>

Windows - PowerShell verification

# Confirm the cumulative update is installed and recent
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 15

# Pull the running OS build - this is what MSRC matches against
Get-ComputerInfo -Property OsBuildNumber, OsVersion, WindowsVersion, OsHardwareAbstractionLayer

# Search the Windows Update history for the KB the advisory references
$Session = New-Object -ComObject Microsoft.Update.Session
$Searcher = $Session.CreateUpdateSearcher()
$Searcher.QueryHistory(0, 50) | Select-Object Title, Date, ResultCode

# Verify Defender signatures are post-patch fresh
Get-MpComputerStatus | Select-Object AntivirusSignatureVersion, AntivirusSignatureLastUpdated

Cloud and container fleet - sweep at scale

# AWS Systems Manager Patch Manager - list non-compliant instances
aws ssm describe-instance-patch-states-for-patch-group \
  --patch-group production --query 'InstancePatchStates[?ComplianceLevel==`CRITICAL`]'

# Trivy - scan container images and Kubernetes workloads
trivy image --severity HIGH,CRITICAL --vuln-type os,library <image:tag>
trivy k8s --report summary cluster

# Kubernetes - find pods running the affected image tag
kubectl get pods -A -o jsonpath='{range .items[*]}{.metadata.namespace}{"/"}{.metadata.name}{" "}{.spec.containers[*].image}{"\n"}{end}' \
  | grep -i <component>

India compliance notes

The six-hour CERT-In clock

I treat the CERT-In six-hour window as a hard SLA. Pre-fill Form-1. Rehearse the submission flow once a quarter. When CVE-2026-35575 or anything like it lands, the on-call lead opens the template, fills in five fields, and submits. Total elapsed time should not exceed twenty minutes once the incident is classified as material.

RBI, SEBI, IRDAI - BFSI overlap

India BFSI fines for late or missed incident reporting routinely fall in the Rs 35-50 crore band including fines, remediation, and customer notification costs. Add another Rs 3,500 to 6,500 per hour ($250 to $450) for external incident-response consultants. The IBM Cost of a Data Breach 2024 report puts the global average at $4.45 million per breach - India sits below that average for the median incident, but well above it for a regulated BFSI event.

MeitY and consent-manager paperwork

If your workload handles personal data under DPDP, MeitY's breach-notification chain runs in parallel with CERT-In. Your consent manager registration and your DPO contact must be current. CVE-2026-35575 does not by itself create a DPDP obligation - but if it could have exposed personal data, you are on the clock.

Real-world incident I patched

Last quarter I closed out a near-miss that mirrors CVE-2026-35575. A Mumbai BFSI customer was running the affected component behind a load balancer with TLS termination. Their internal red team found the crm (bundle sibling) primitive during a routine purple-team exercise the same week the MSRC advisory dropped. Embarrassing in the moment. Useful in retrospect.

The red team's writeup gave us a working PoC in a contained lab. We mapped the detection rule into the SIEM the same day, deployed it to the prod ruleset by end of business, and rolled the vendor patch through the standby-first HA sequence over the weekend. Total spend on the engagement was about Rs 9.1 lakh ($11,000) including the red-team retainer and the IR analyst hours.

What I want you to take from the story: a high-CVSS bug in the affected component is not theoretical. It is something a competent red team can reproduce inside a week and an opportunistic operator can weaponise inside a month. Patch first. Detect second. Audit third. Skip any of those three and you end up explaining to the regulator why the IBM $4.45M number is no longer hypothetical.

FAQs extended

How do I prioritise CVE-2026-35575 against the rest of this month's patch backlog?

CVSS 8 with a network or adjacent attack vector goes to the top of the queue. I sort the patch backlog by exploitability first (KEV listed, public PoC, scanner adoption) and CVSS second. CVE-2026-35575 sits in the upper band for the affected component, so it does not wait for the monthly cycle. It catches the emergency change window.

Will my SIEM catch exploitation if I cannot patch right away?

Maybe. Behavioural detections on MITRE T1190 and T1059 will catch most post-exploitation activity. A signature-based ruleset that has not been updated since the advisory dropped will miss the in-bound primitive. Update your rules monthly. Tabletop quarterly. Patch as the durable answer.

What does the IBM Cost of a Data Breach $4.45M number mean for me?

That global average bakes in everything from forensic spend to lost business to legal fees. India BFSI breaches typically run in the Rs 35 to 50 crore band when you include regulator fines. Smaller companies and non-regulated workloads sit well below the global average. Use the number as a forcing function, not as a literal forecast.

Do I have to file with CERT-In if I patched before exploitation?

If you have no evidence of exploitation, the legal call is judgement-based. Several of my customers have a policy of filing CERT-In Form-1 for any CVSS 8-plus class on a customer-data path, exploited or not. The acknowledgement itself becomes useful evidence in the next audit. Cost of filing - about an hour of analyst time. Cost of not filing when you should have - multiples of that.

How do I prove CVE-2026-35575 is closed to my auditor?

Three artefacts. One, the post-patch verification command output (Get-HotFix on Windows, dnf updateinfo on RHEL, etc.) timestamped. Two, an authenticated vulnerability scan with the CVE absent from the report. Three, a SIEM query covering the disclosure window with no IOC hits. Bundle them as a single PDF and the auditor moves on.

What is the realistic patch window I should plan for the affected component?

Plan for 72 hours from advisory drop to fully patched in production. The first 12 hours go to staging and smoke tests. The next 24 hours go to the staggered HA rollout. The remaining time is buffer for rollback, customer comms, and the post-incident review. Faster is possible. 72 hours is a sane SLA target.