CVE-2026-37713 is a high severity remote code execution vulnerability affecting Dolibarr ERP/CRM versions 22.0.0 through 22.0.4 and 24.0.0-alpha. The issue resides in the htdocs/core/class/commonobject.class.php file, allowing an unauthenticated remote attacker to execute arbitrary code. The vulnerability is categorized under CWE-94 (Improper Control of Generation of Code). The CVSS 3.1 base score is 7.3 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, indicating network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability. No patch or official remediation level is currently documented.

Successful exploitation allows remote attackers to execute arbitrary code on affected Dolibarr ERP/CRM installations, potentially leading to partial confidentiality, integrity, and availability loss. This could compromise the affected system and its data. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider restricting external access to the affected Dolibarr ERP/CRM instances and monitor for unusual activity related to the vulnerable component. Avoid exposing the affected versions to untrusted networks.