Resolved
Security update · 21 October 2026
Critical PHP vulnerability: fixed
In short: the issue is fixed, and for most customers there is nothing you need to do.
Due to the critical PHP vulnerability (CVSS 9.2), we’ve patched everything that was affected. Here is where things stand.
✓ Cloud
The affected PHP versions are patched across our Cloud products. We did this on 21 October. You don’t need to do anything.
✓ Lime CRM
The vulnerability affected Forms, Portal and Signatures. All three are patched. You don’t need to do anything.
✓ On-premise
The Lime CRM core product is not affected. The only on-premise customers affected are those running Forms or Portal on-premise. We reached out to every customer running an affected version on 21 October. If you are running Forms or Portal on-premise and haven’t heard from us, get in touch and we’ll sort it.
Questions? Contact Lime Support
Get help in the way that suits you best
Our incredible support team is here to help you every step of the way.
Opening hours: Monday – Friday, 8:00 AM – 5:00 PM
Quick Help for Lime CRM
We’re here to help you get the most out of Lime CRM
