All vulnerabilities
CVE-2026-90817

REDCap: An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in which a malicious user could potentially exploit it by manipulat

Vanderbilt University REDCap
Open in ThreatlineRecord JSON
CVSS
9.8Critical
ExploitationScanner template publicA Nuclei template detects it. Not in the KEV catalogNuclei
Exploit odds (EPSS)3.75%Chance of exploitation activity in the next 30 days, higher than 89% of CVEs. Scored 27 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published20 Sep 2026Updated 21 Sep 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Timeline

  1. 20 Sep 2026, 12:05 UTCPublishedCVE List
  2. 27 Oct 2026, 08:24 UTCExploit code publicGitHub proof-of-concept repositories

Public exploit code and templates 1

  • Scanner templateREDCap >= 13.3.0 - Unauthenticated Remote Code Execution via Survey PassthruNuclei

Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

Description

An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in which a malicious user could potentially exploit it by manipulating HTTP requests to access an unintended controller route from a public survey context and by supplying a crafted file-path/stream parameter during import handling. If successfully exploited, this could allow the attacker to remotely execute arbitrary code on the REDCap server. The attacker does not have to be authenticated in order to exploit this, but exploitation requires knowledge of a valid public survey hash. This vulnerability exists in REDCap 13.3.0 and higher.

Text from CVE List

Affected versions 4

  • REDCapaffected: 13.3.0CVE List
  • REDCapunaffected: 16.0.49CVE List
  • REDCapunaffected: 17.3.10CVE List
  • REDCapunaffected: 17.4.4CVE List

References 1