CVE-2006-2460: Sugar Suite Open Source (SugarCRM) 4.2 and earlier, when register_globals is enabled, does not protect crit...

Security readout for executives and security teams

This is an old Sugar Suite Open Source issue affecting version 4.2 and earlier when PHP register_globals is enabled. Attackers could tamper with critical runtime variables and trigger dangerous outcomes such as directory traversal or remote file inclusion. The source bundle includes exploit references, but does not show CISA KEV listing or current active exploitation. Exposure is likely limited to legacy Sugar Suite Open Source 4.2 or earlier deployments running on PHP configurations with register_globals enabled. Modern SugarCRM or PHP environments may not be affected by this exact condition, but the source bundle does not define unaffected versions. Treat as high priority only if legacy Sugar Suite 4.2 or earlier is still present. The business risk is highest for internet-facing CRM systems because compromise could expose customer data or provide a foothold. If no such legacy deployment exists, residual risk is low. Mitigation focus: Identify any Sugar Suite Open Source 4.2 or earlier instances.; Disable PHP register_globals where it is still enabled.; Check SugarCRM or vendor guidance for fixed versions or migration direction..

Prepared

Jun 29, 2026, 12:43 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.