Skip to content
New RCE Vulnerability Discovered in REDCap (CVE-2026-90817)

New RCE Vulnerability Discovered in REDCap (CVE-2026-90817)

First seen 24 Sep 2026, 09:55 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •September 25, 2026 at 09:28 UTC
  • •CVE-2026-90817 allows RCE in REDCap versions 13.3.0 and above.
  • •Exploit requires a valid public survey hash for full chain execution.
  • •No complete PoC is publicly available yet; only a checker tool has been released.

A remote code execution vulnerability (CVE-2026-90817) has been identified in REDCap versions 13.3.0 and above, allowing attackers to exploit public survey hashes to access unintended controllers. The vulnerability arises from unsafe file-path handling through the `__passthru` routing mechanism. Securifera, the discoverer, has not yet released a complete proof-of-concept (PoC), but a Python 3 checker and exploit hook have been made available for research purposes. The vulnerability was published on September 20, 2026, and the first public PoC was released on September 21, 2026. Affected users are urged to upgrade to fixed versions 16.0.49 LTS, 17.3.10 LTS, or 17.4.4 Standard+. The exploit requires a valid public survey hash for full functionality, and the tool includes features for single and mass checks against vulnerable instances.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 50d ago How this analysis works

Timeline

2026-09-20
CVE-2026-90817 published
A remote code execution vulnerability in REDCap was publicly disclosed, affecting versions 13.3.0 and above.
Sploitus
2026-09-21
First public PoC released
Securifera released the first public proof-of-concept for CVE-2026-90817, enabling testing for the vulnerability.
Sploitus
2026-09-24
Exploit tool released
A Python 3 checker and configurable exploit hook for CVE-2026-90817 was published, allowing researchers to probe affected systems.
Sploitus

More articles in this cluster (3)

Following this threat?

Track CVE-2026-90817 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (5)

1 / 3