CVE-2026-90817Disclosure

HIGHCVSS 9.8 · CRITICAL

Exploitation observed; activity peaked at 6 mentions and remains active

Immediate actions

Patch affected systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in which a malicious user could potentially exploit it by manipulating HTTP requests to access an unintended controller route from a public survey context and by supplying a crafted file-path/stream parameter during import handling. If successfully exploited, this could allow the attacker to remotely execute arbitrary code on the REDCap server. The attacker does not have to be authenticated in order to exploit this, but exploitation requires knowledge of a valid public survey hash. This vulnerability exists in REDCap 13.3.0 and higher.

Back to dashboard

7.8/ 10 priority

Sources & remediation

Other references

https://www.securifera.com/advisories/

Weakness type (CWE)

CWE-73CWE-94

Priority

HIGH

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Active exploitation appears in 5 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
24 mentions across 12 observed days

What's happening

Active exploitation reported across 5 signals
Exploit tool or code specified in 5 signals
PoC mentioned or linked in 8 signals
Patch or workaround mentioned in 9 signals
Technical details provided in 19 signals
Disclosure: 7 classified signals
Peaked 10d ago at 6 mentions (2026-09-21); latest day: 1
24 total mentions across 12 days

Deep dive

Activity timeline24 mentions / 12d

Signal classification6 categories

Disclosure

729.2%

PoC

625.0%

Active Exploitation

520.8%

Patch

416.7%

Exploit

14.2%

General

14.2%

Referenced assets13 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-20	1	Disclosure1
2026-09-21	6	Disclosure4Patch1PoC1
2026-09-22	3	Patch2PoC1
2026-09-23	3	Exploit1General1PoC1
2026-09-24	1	PoC1
2026-09-29	1	Patch1
2026-10-02	1	PoC1
2026-10-05	1	Disclosure1
2026-10-13	3	Active Exploitation3
2026-10-15	2	Active Exploitation2
2026-10-23	1	PoC1
2026-11-01	1	Disclosure1

Full discourse20 posts

Unit 42@Unit42_Intel24d
Active Exploitation
We've observed in-the-wild exploitation of CVE-2026-90817. Attackers abused public survey endpoints to bypass admin access controls and deploy evasive cryptocurrency mining payloads. More info at https://bit.ly/4jdVcGD https://t.co/namY7UDEMK
Post summary
The text reports confirmed in-the-wild exploitation of CVE-2026-90817 via survey endpoint abuse to bypass admin controls and deploy crypto mining payloads, with no mention of a PoC, exploit tool, or patch.
24832288119.1K
71.5K followersView on X
b0yd@rwincey37d
Patch
Another RCE. CVE-2026-90817 in REDCap. This is easily one of my favorites as GPT 5.6 sol helped me extend on Synacktiv's php://filter byte generator trick to land the exploit. Patch now. https://www.securifera.com/blog/2026/09/27/survey-says-remote-code-execution-cve-2026-90817/
Post summary
The tweet reports an RCE vulnerability (CVE‑2026‑90817) in REDCap, provides technical exploitation details, and urges users to apply a patch promptly.
111103959
2.0K followersView on X
Rıdvan Yağlı@ridvanyagli44d
PoC
🔴 REDCap için unauthenticated RCE açığına (CVE-2026-90817 - CVSS 9.8 Critical) yönelik mass-check PoC yayınlandı. PoC; public survey hash ('s=') üzerinden __passthru -> Data Import erişimini kontrol ederek etkilenen sistemleri belirlemeye çalışıyor. ⚠️ Tam RCE zinciri henüz yayımlanmış değil; repo'daki exploit chain placeholder durumda. https://github.com/murrez/CVE-2026-90817
Post summary
A critical (CVSS 9.8) unauthenticated RCE vulnerability in REDCap (CVE-2026-90817) has had a mass-check PoC published on GitHub, which uses the public survey hash parameter to identify vulnerable systems. The full RCE chain is currently a placeholder and not yet fully disclosed.
00095902
2.5K followersView on X
Ryx@PadhiyarRushi34d
PoC
REDCap survey hash is enough. Data Import route runs as the public survey! CVE-2026-90817 (CVSS 9.8): REDCap 13.3.0 and higher. Survey passthrough routing reaches a controller that was not meant to be public, then the import handler takes a file-path/stream parameter. No account. Needs a valid public survey hash. Finder: Ryan Wincey, Securifera. Unaffected: 16.0.49, 17.3.10, 17.4.4. PoC repo landed 1 Oct. https://github.com/securifera/CVE-2026-90817 #Cybersecurity #AI #AISecurity #MCP #Claude #GPT #Infosec #Trending #AppSec #RCE #BugBounty
Post summary
A high‑severity RCE vulnerability (CVE‑2026‑90817, CVSS 9.8) affecting REDCap 13.3.0+ is disclosed, with a proof‑of‑concept repository released for further testing.
11064308
954 followersView on X
Dark Web Intelligence@DailyDarkWeb45d
Disclosure
🚨 CRITICAL REDCAP RCE DISCLOSED — PUBLIC SURVEY CONTEXT CAN LEAD TO SERVER CODE EXECUTION A newly published vulnerability in Vanderbilt University's REDCap research-data platform allows remote code execution without authentication. • CVE-2026-90817 — CVSS 9.8 Critical • Published September 20, 2026 • The flaw affects REDCap's survey passthrough routing and Data Import processing logic • An attacker can manipulate HTTP requests to reach an unintended controller route and supply a crafted file-path/stream parameter • Successful exploitation can execute arbitrary code on the REDCap server • Authentication is NOT required • Exploitation does require knowledge of a valid public survey hash — notable because public survey links are designed to be distributed externally • The CVE record describes REDCap 13.3.0 and higher as affected; structured version data lists 16.0.49, 17.3.10 and 17.4.4 as unaffected releases • No public PoC or confirmed in-the-wild exploitation has been identified at this time ⚠️ Analyst Note: REDCap is used for research and clinical data collection, making server-side compromise potentially significant where deployments contain sensitive study or participant information. The attack prerequisite is also unusual: rather than requiring an account, the attacker needs a valid public survey hash. Organizations operating internet-facing REDCap deployments should verify their exact version and remediation status immediately. Original CVE record: https://www.cve.org/CVERecord?id=CVE-2026-90817 #REDCap #CVE202690817 #RCE #Vulnerability #HealthcareSecurity #CyberSecurity #ThreatIntel #DDW #DarkWeb
Post summary
The tweet discloses a critical unauthenticated RCE vulnerability (CVE-2026-90817) in REDCap, noting its CVSS score, technical flaw, and that no public PoC or in-the-wild exploitation is known.
000927.2K
209.0K followersView on X
skinnyguinea@_skinnyguinea24d
Active Exploitation
Actively exploited: CVE-2026-90817 turns a public REDCap survey hash into unauthenticated RCE. Unit 42 watched attackers stage a Blade webshell, pull XMRig disguised as a JPG, then rename the miner as syslog so it blends in. Patch REDCap and hunt temp/cache plus syslog-themed processes that shouldn't be there. Research and hospital installs are the obvious target set.
Post summary
The text reports active exploitation of CVE-2026-90817 by Unit 42, where attackers exploit a REDCap survey hash for unauthenticated RCE, deploying a Blade webshell and XMRig miner disguised as system logs, with patching REDCap recommended as remediation.
10120140
124 followersView on X
Cyber Threat Observatory | Alan Turing Institute@TuringCyberObs45d
Disclosure
CVE-2026-90817 REDCap Unauthenticated RCE could expose clinical trial, patient-linked and research data in affected REDCap survey deployments Full analysis: https://github.com/alan-turing-institute/cyber-threat-observatory/blob/main/reports/2026-09-20/TIER_2_CVE-2026-90817.md #CyberSecurity #HealthcareCybersecurity #VulnerabilityManagement
Post summary
The tweet announces a critical unauthenticated RCE vulnerability in REDCap survey deployments (CVE-2026-90817) that could expose sensitive clinical and patient data, linking to a full analysis report for further technical details.
11011137
63 followersView on X
pdnuclei-bot@pdnuclei_bot13d
PoC
🚨 CVE-2026-90817 - critical 🚨 REDCap >= 13.3.0 - Unauthenticated Remote Code Execution via Survey Passthru > REDCap versions 13.3.0 through 16.0.48 LTS, 17.3.9 LTS, and 17.4.3 Standard contain a... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-90817 @pdnuclei #Nucle...
Post summary
The tweet announces CVE-2026-90817 as a critical unauthenticated RCE in REDCap and links to a ProjectDiscovery PoC/technical details page, with Nuclei tooling referenced, but does not mention active exploitation, a patch, or an exploit tool.
00021149
1.4K followersView on X
ExploitGrid@exploitgrid43d
General
🛡️ #ExploitGrid Daily #Threat Digest Critical Exploits disclosed today: CVE-2025-6325, CVE-2025-6327 CVE-2024-21413 CVE-2026-14894 CVE-2026-90817 CVE-2026-90817 ..🧵👇
Post summary
No text containing CVEs or vulnerability information was provided in the input following the 'Text' label; all indicators are marked NO based on the absence of analysis content.
1101055
227 followersView on X
Ryan Merck@rmerck45d
Patch
Public survey hash is enough. REDCap on 13.3.0+ let survey passthrough reach Data Import and run unauth RCE. CVE-2026-90817. Clinical stacks still on those builds should already be on 16.0.49, 17.3.10, or 17.4.4. https://www.cve.org/CVERecord?id=CVE-2026-90817
Post summary
The text discloses CVE-2026-90817 affecting REDCap versions 13.3.0+ enabling unauthenticated RCE and specifies remediated versions (16.0.49, 17.3.10, 17.4.4) for mitigation.
2001068
46 followersView on X
mürrez@murrezsec45d
PoC
CVE-2026-90817 — REDCap unauth RCE (CVSS 9.8) Survey __passthru + Data Import. Public survey hash (s=) required. Python mass checker + __passthru probes. Full exploit chain not public yet. Patch: 16.0.49 / 17.3.10 / 17.4.4 https://github.com/murrez/CVE-2026-90817 #REDCap #InfoSec #cve #poc
Post summary
CVE-2026-90817 is an unauthenticated RCE in REDCap (CVSS 9.8) via survey __passthru + Data Import; a PoC is linked on GitHub, a Python mass checker is referenced, patches are available (16.0.49/17.3.10/17.4.4), but no active exploitation is reported.
00030166
636 followersView on X
Read the Diff@read__the__diff23d
Active Exploitation
‼️ ‼ A public survey link is all it takes to run code on a REDCap server, and attackers are already inside: CVE-2026-90817, CVSS 9.8, exploited in the wild. REDCap is the survey tool research teams use to collect patient data, and a survey hash is the short code in the link you hand out so people can answer without logging in. That code is public by design, which is why the flaw needs no password: whoever knows a live hash can reach the code that renders the survey and run their own on the server. Unit 42 watched the intrusion unfold. The entry point was that hash. From there the attackers dropped a Blade webshell, a small file that keeps a door open so they can come back and type commands whenever they want, then pulled XMRig, a miner that spends the machine's processor on someone else's cryptocurrency. The miner arrived dressed as a JPG and was renamed to look like syslog, the log file every Unix machine writes, so a glance at the process list shows nothing odd. That last move is the one worth copying into your own detection: the disguise is a filename, not a technique. A file called syslog that holds a running process, or a survey endpoint spawning anything at all, is the signal. What to do: patch REDCap to the fixed release, then hunt the temp and cache directories for webshells and for anything named after a log file. Put a rule on the survey endpoints so a request that ends in code execution raises an alert, and check whether your public survey hashes are guessable or enumerable, because that is the only thing standing between a scanner and your data. Early report: these facts come from first disclosures and are not confirmed yet. Expect them to change.
Post summary
The text reports CVE-2026-90817 in REDCap (CVSS 9.8) as actively exploited in the wild, with attackers using a survey hash to deploy a Blade webshell and XMRig cryptominer, and recommends patching to the fixed release.
1000056
202 followersView on X
ExploitGrid@exploitgrid42d
PoC
💀 CRITICAL Exploits Trending ├ CVE-2025-6325 / CVE-2025-6327 · PoC live ├ CVE-2024-21413 — "MonikerLink" · PoC live └ CVE-2026-14894 · CVE-2026-90817 · PoC live
Post summary
The tweet highlights that Proof of Concept code is publicly available and live for several recently disclosed CVEs, indicating trending critical exploits.
1000039
308 followersView on X
ExploitGrid@exploitgrid43d
PoC
[EXPLOIT] CVE-2026-90817 [CRITICAL/PoC] CVE-2026-90817 🔗 https://exploitgrid.net/exploits/c94ea2f6-d309-4b98-bb62-d98f742af06f
Post summary
The text announces CVE-2026-90817 as critical, indicates a PoC exists or is linked, but provides no technical details, patch, or named exploit tool.
1000026
227 followersView on X
ExploitGrid@exploitgrid43d
Exploit
[EXPLOIT] CVE-2026-90817 [CRITICAL/PoC] CVE-2026-90817 🔗 https://exploitgrid.net/exploits/5ed7780c-b10b-48ca-b38d-583b96a95b14
Post summary
The post announces the availability of a functional exploit for CVE-2026-90817, explicitly tagged as an exploit and PoC, with a direct link to the exploit code repository on exploitgrid.net.
1000031
227 followersView on X
0xTangent@loftyarcher45d
Disclosure
Survey hash as enough auth for Data Import is why REDCap CVE-2026-90817 turns a public survey into unauth RCE. The check is treating survey passthrough as hostile until import paths require real session auth and least privilege — hash-only gates are not auth. Are clinical stacks still on the listed vulnerable builds?
Post summary
The text details REDCap CVE-2026-90817, explaining that using a survey hash as authentication for data import allows unauthenticated remote code execution, and emphasizes that import paths must require real session authentication and least privilege.
1000051
294 followersView on X
Hardik Dagha@HardikDagha45d
Disclosure
REDCap CVE-2026-90817 is a CVSS 9.8 unauthenticated RCE. Public survey passthrough routing plus Data Import file handling can let an attacker run code with no login, if they have a valid public survey hash. Affects 13.3.0 and later on clinical and research platforms.
Post summary
The tweet discloses a newly assigned CVE-2026-90817, a CVSS 9.8 unauthenticated remote code execution in REDCap affecting version 13.3.0 and later, exploitable via public survey routing and Data Import file handling with a valid public survey hash, but provides no PoC, exploit, patch, or active exploitation information.
1000059
10 followersView on X
CVE@CVEnew46d
Disclosure
CVE-2026-90817 An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in which a malicious user could p… https://www.cve.org/CVERecord?id=CVE-2026-90817
Post summary
The post announces CVE-2026-90817 as an unauthenticated RCE in survey passthrough routing and Data Import processing, providing basic technical details without referencing exploits, patches, or active attacks.
000101.2K
58.1K followersView on X
Hugo | DevOps | Cybersecurity@HugoValters5d
Disclosure
CVE-2026-90817: unauthenticated RCE in REDCap survey passthrough and Data Import routing. CVSS 9.8, no patch confirmed. Treat exposed instances as at risk and restrict access now. #CVE #infosec #cybersecurity https://www.valtersit.com/cve/CVE-2026-90817/ #REDCap #CVEALERT #CVE #infosec #Linux #XSS #valtersit #snippet #SysAdmin #cybersecurity #devsecops #devops #developer #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #hacker #kali #ubuntu #debian #docker
Post summary
The text discloses CVE-2026-90817, an unauthenticated RCE in REDCap with CVSS 9.8, and notes no patch is confirmed. It does not mention PoC code, exploit tools, or active in-the-wild exploitation.
0000055
1.1K followersView on X
Frontline Consultant@FrontlineTalks21d
Active Exploitation
REDCap runs surveys for a lot of clinics and research teams, and CVE-2026-90817 is being exploited in the wild. Patching closes the hole, but if your server was exposed, check it for anything new that shouldn't be there. https://frontlineconsultant.com #CyberSecurity #REDCap
Post summary
The tweet reports that CVE-2026-90817 affecting REDCap is being actively exploited in the wild and advises patching and checking servers for unauthorized changes.
0000020
44 followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-90817

Rıdvan Yağlı[verified]@ridvanyagliPoC

A critical (CVSS 9.8) unauthenticated RCE vulnerability in REDCap (CVE-2026-90817) has had a mass-check PoC published on GitHub, which uses the public survey hash parameter to identify vulnerable systems. The full RCE chain is currently a placeholder and not yet fully disclosed.

Ryx[verified]@PadhiyarRushiPoC

A high‑severity RCE vulnerability (CVE‑2026‑90817, CVSS 9.8) affecting REDCap 13.3.0+ is disclosed, with a proof‑of‑concept repository released for further testing.

Dark Web Intelligence[verified]@DailyDarkWebDisclosure

The tweet discloses a critical unauthenticated RCE vulnerability (CVE-2026-90817) in REDCap, noting its CVSS score, technical flaw, and that no public PoC or in-the-wild exploitation is known.

skinnyguinea[verified]@_skinnyguineaActive Exploitation

The text reports active exploitation of CVE-2026-90817 by Unit 42, where attackers exploit a REDCap survey hash for unauthenticated RCE, deploying a Blade webshell and XMRig miner disguised as system logs, with patching REDCap recommended as remediation.

Ryan Merck[verified]@rmerckPatch

The text discloses CVE-2026-90817 affecting REDCap versions 13.3.0+ enabling unauthenticated RCE and specifies remediated versions (16.0.49, 17.3.10, 17.4.4) for mitigation.

Read the Diff[verified]@read__the__diffActive Exploitation

The text reports CVE-2026-90817 in REDCap (CVSS 9.8) as actively exploited in the wild, with attackers using a survey hash to deploy a Blade webshell and XMRig cryptominer, and recommends patching to the fixed release.

0xTangent[verified]@loftyarcherDisclosure

The text details REDCap CVE-2026-90817, explaining that using a survey hash as authentication for data import allows unauthenticated remote code execution, and emphasizes that import paths must require real session authentication and least privilege.

Hugo | DevOps | Cybersecurity[verified]@HugoValtersDisclosure

The text discloses CVE-2026-90817, an unauthenticated RCE in REDCap with CVSS 9.8, and notes no patch is confirmed. It does not mention PoC code, exploit tools, or active in-the-wild exploitation.