Unauthenticated RCE in REDCap via survey routing and data import handler
CVE-2026-90817: unauthenticated RCE in REDCap (CVSS 9.8). Public survey endpoint allows arbitrary code execution on the server without credentials. Patched.
- Vendor
- Project REDCap
- Product
- REDCap
- CVSS
- 9.8
- EPSS (exploit probability)
- 3.7%
- Status
- patched
- Published
Is CVE-2026-90817 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-90817 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-11-13 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 3.7% (scored October 25, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-13. Full cross-catalog view: /kev-comparison
CVE-2026-90817 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
Unauthenticated remote code execution in REDCap. The vulnerability spans two components: the survey passthrough routing module, which accepts crafted HTTP requests that reach controller routes outside the intended public-facing scope, and the data import handler, which processes file-path and stream parameters without adequate restriction. Combining both conditions from the public survey entry point allows arbitrary code execution on the server without any credentials.
Consult the Securifera advisory for affected versions and patch details.
