CVE-2026-90817 json
An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in whi…
published last mo. modified last mo. also EUVD-2026-83738
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 3.7%
- EPSS 3.7% chance of exploitation in 30 days, percentile 90%
- public exploits
- 0
- none known
Summary
An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in which a malicious user could potentially exploit it by manipulating HTTP requests to access an unintended controller route from a public survey context and by supplying a crafted file-path/stream parameter during import handling. If successfully exploited, this could allow the attacker to remotely execute arbitrary code on the REDCap server. The attacker does not have to be authenticated in order to exploit this, but exploitation requires knowledge of a valid public survey hash. This vulnerability exists in REDCap 13.3.0 and higher.
Patch / fix
- Vanderbilt University REDCap 16.0.49, 17.3.10, 17.4.4
Is CVE-2026-90817 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- last mo.
Exploit prediction
3.75% chance of exploitation in the next 30 days, higher than 90% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
- Vanderbilt University REDCap
Classification
References
Sources
- CVE List CVE-2026-90817
- NVD CVE-2026-90817
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.