REDCap — Unauthenticated Remote Code Execution
Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 9.8, CVEs: CVE-2026-90817, Summary: A critical remote code execution vulnerability has been disclosed in REDCap. CVE-2026-90817 affects survey passthrough routing and Data Import processing and can allow an unauthenticated attacker to execute arbitrary code on the REDCap server. Exploitation requires knowledge of a valid public survey hash. An attacker with such a hash can manipulate HTTP requests to reach…
EPSS 0.01 CVSS 9.8 CVE-2026-90817 REDCap FI