# CVE-2026-90817: REDCap - RCE

> Live exploitation tracking for CVE-2026-90817 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-90817

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** Vanderbilt University REDCap
- **Weaknesses:** CWE-94 (Improper Control of Generation of Code ('Code Injection')); CWE-73 (External Control of File Name or Path)
- **Tags:** web_application

## Description

An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in which a malicious user could potentially exploit it by manipulating HTTP requests to access an unintended controller route from a public survey context and by supplying a crafted file-path/stream parameter during import handling. If successfully exploited, this could allow the attacker to remotely execute arbitrary code on the REDCap server. The attacker does not have to be authenticated in order to exploit this, but exploitation requires knowledge of a valid public survey hash. This vulnerability exists in REDCap 13.3.0 and higher.

## CrowdSec analysis

[CVE-2026-90817](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-90817) is a critical unauthenticated remote code execution vulnerability in REDCap 13.3.0 and higher, involving survey passthrough routing and Data Import processing. An attacker who knows a valid public survey hash could manipulate HTTP requests and provide a crafted file-path or stream parameter to execute arbitrary code on the REDCap server.

CrowdSec has been tracking this vulnerability and its exploits since 24th of October 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2026-90817 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Observed exploitation attempts target REDCap public survey endpoints under `/surveys/` and include the double-URL-encoded `__passthru=%2569ndex.php` parameter to bypass authentication and route requests to internal controllers. The template’s probe also uses `route=ParcelController%3Ashow`.

## Timeline

- 2026-09-20: CVE Published. CVE-2026-90817 is published to NVD.
- 2026-10-24: Rule Released. CrowdSec releases a rule to detect CVE-2026-90817 exploitation attempts against the CrowdSec Network.

## References

- https://www.securifera.com/advisories/
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-90817.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-90817) follows observed exploitation activity for CVE-2026-90817. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.