{"slug":"redcap-cve-2026-90817","title":"REDCap unauthenticated survey RCE (CVE-2026-90817)","shortName":"REDCap","summary":"Unauthenticated remote code execution in Vanderbilt REDCap survey passthrough routing and Data Import handling (CVE-2026-90817, CWE-73/94). No login is required, but a published public survey hash is. NVD republishes the Securifera CNA CVSS 3.1 9.8. Fixed builds from the CVE.org CNA record: 16.0.49 LTS, 17.3.10 LTS, and 17.4.4 Standard. A public Vanderbilt advisory was not opened. Reported exploited (Unit 42, 7 Oct 2026), not confirmed. Not in CISA KEV (catalog 2026.10.30, checked 1 Nov 2026).","isExample":false,"draft":false,"family":"redcap-cve-2026-90817","kind":"single-product","aliases":["CVE-2026-90817","REDCap","Vanderbilt REDCap"],"publishedAt":"2026-11-01","updatedAt":"2026-11-01","patchStatus":"patched","exploited":"reported","scores":{"cve":"CVE-2026-90817","cvss":{"cve":"CVE-2026-90817","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1","scorer":"cna","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-90817","sourceDate":"2026-09-22","checkedDate":"2026-11-01","dateLabel":"NVD lastModified; Awaiting Analysis","sourceLabel":"NVD CNA metric (Securifera; Secondary CVSS 3.1)","nvdPublishedDate":"2026-09-20"},"epss":{"cve":"CVE-2026-90817","score":0.03749,"percentile":0.89874,"date":"2026-10-31","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-90817","checkedDate":"2026-11-01"},"kev":{"cve":"CVE-2026-90817","listed":false,"dateAdded":null,"dueDate":null,"catalogVersion":"2026.10.30","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","checkedDate":"2026-11-01"},"addedDate":"2026-11-01"},"priority":{"label":"act-now"},"managementSummary":{"what":"Unauthenticated remote code execution in Vanderbilt REDCap (CVE-2026-90817). NVD republishes the Securifera CNA CVSS 3.1 9.8. No login is required, but a published public survey hash is. Reported exploited (Unit 42, 7 Oct 2026), not confirmed. Not in CISA KEV (checked 1 Nov 2026). Fixed builds come from the CVE.org CNA record, not a public Vanderbilt advisory.","action":"Upgrade REDCap to 16.0.49 LTS, 17.3.10 LTS, or 17.4.4 Standard, or a later build that includes the fix. If you cannot patch yet, restrict or disable public surveys. If a public survey was reachable on an affected build, hunt Unit 42 artefacts and treat secrets the web process could reach as exposed."},"seenInTheWild":[{"metric":"third-party-stated","value":"At least four live XMRig worker instances","observer":"Unit 42","date":"2026-10-07","method":"Unit 42 timely threat intel note 7 Oct 2026. Third-party report of in-the-wild use: a webshell via public survey endpoints, then an in-memory chain that deployed XMRig. Pool-wallet telemetry named at least four concurrent workers. Not a vendor or government confirmation. Not in CISA KEV.","sourceUrl":"https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-10-07-XMRig-campaign-through-CVE-2026-90817.txt"}],"seenInTheWildLinks":[{"title":"Unit 42: XMRig campaign through CVE-2026-90817 (7 Oct 2026)","url":"https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-10-07-XMRig-campaign-through-CVE-2026-90817.txt","observer":"Unit 42","metric":"third-party-stated"}],"whatChanged":{"date":"2026-11-01","items":[{"text":"New catalog page for Vanderbilt REDCap unauthenticated survey remote code execution (CVE-2026-90817).","headline":"New catalog page for REDCap CVE-2026-90817","section":"overview","date":"2026-11-01","kind":"page"},{"text":"Unit 42 (7 Oct 2026) reported in-the-wild use of CVE-2026-90817 for a webshell then fileless XMRig campaign, with at least four live worker instances on pool data. This page records that as reported exploitation, not confirmed. Not in CISA KEV (catalog 2026.10.30, checked 1 Nov 2026).","headline":"Unit 42 reported in-the-wild XMRig use on 7 Oct 2026","section":"exploitation","date":"2026-11-01","sourceUrl":"https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-10-07-XMRig-campaign-through-CVE-2026-90817.txt"},{"text":"Added Am I affected checks, mitigations and response guidance","headline":"Added Am I affected checks, mitigations and response guidance","section":"am-i-affected","date":"2026-11-01","kind":"page"}]},"whatTheBugIs":"CVE-2026-90817 is an unauthenticated remote code execution issue in Vanderbilt University REDCap. The CVE.org CNA record (Securifera, published 20 Sep 2026 12:05 UTC, updated 21 Sep 2026, checked 1 Nov 2026) says: An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in which a malicious user could potentially exploit it by manipulating HTTP requests to access an unintended controller route from a public survey context and by supplying a crafted file-path/stream parameter during import handling. If successfully exploited, this could allow the attacker to remotely execute arbitrary code on the REDCap server. The attacker does not have to be authenticated in order to exploit this, but exploitation requires knowledge of a valid public survey hash. This vulnerability exists in REDCap 13.3.0 and higher.\n\nThe CNA is Securifera (contact@securifera.com; finder credit Ryan Wincey). The CVE.org affected list names Vanderbilt University REDCap 13.3.0 as affected and 16.0.49, 17.3.10, and 17.4.4 as unaffected. The same record's solution line is: Upgrade to REDCap 16.0.49 LTS, 17.3.10 LTS, or 17.4.4 Standard Release, as applicable. This page uses that CVE.org record for the version table. A public Vanderbilt REDCap advisory was not opened. IONIX (22 Sep 2026) restates the same LTS/Standard builds.\n\nNVD republishes the CNA record (published 20 Sep 2026 13:17 UTC, lastModified 22 Sep 2026, status Awaiting Analysis, checked 1 Nov 2026) with a Secondary CVSS 3.1 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and CWE-73 and CWE-94. NVD has no NVD-produced metric yet.\n\nThe Securifera advisories index (opened 1 Nov 2026) lists REDCap DataImport Remote Code Execution Vulnerability under CVE-2026-90817 and links the CVE.org record. The same index page also links the 27 Sep 2026 write-up. Securifera (b0yd, 27 Sep 2026) describes a public-survey passthrough that can reach an internal controller, then Data Import handling that writes attacker-selected bytes, which the application later executes. This page does not republish request bodies, filter chains, or exploit steps. Securifera scores CVSS 3.1 9.8 with the same vector.\n\nUnit 42 (7 Oct 2026) reports in-the-wild use: a webshell via public survey endpoints, then fileless XMRig mining, with at least four live worker instances on pool data. Unit 42 also relays a REDCap statement that after learning of this vulnerability in September, REDCap released a software update addressing it within two days. That is a vendor patch-timing paraphrase, not a vendor confirmation or denial of in-the-wild use.\n\nExploitation status: reported exploited (Unit 42, 7 Oct 2026), not confirmed. Not in CISA KEV (catalog 2026.10.30, released 2026-10-30T17:02:45.3665Z, 1,766 entries, checked 1 Nov 2026). The NVD record includes a CISA Coordinator SSVC option exploitation: none dated 21 Sep 2026; that predates the Unit 42 note and is not a KEV listing.","attackPath":{"caption":"High-level only. Not a reproduction guide.","steps":[{"id":"reach","label":"Public survey hash","detail":"Network access to a live published survey. NVD and Securifera: no login, but a valid public survey hash is required."},{"id":"app","label":"Passthrough reaches an internal controller","detail":"NVD / Securifera: survey passthrough routing can reach a controller that was not meant to be public. Conceptual impact class only."},{"id":"unsafe","label":"Data Import file or stream write","detail":"NVD: a crafted file-path or stream parameter during import handling. Securifera: attacker-selected bytes are written. Conceptual impact class only."},{"id":"exec","label":"Code as the web user","detail":"NVD: arbitrary code on the REDCap server. Securifera: the application later executes the written bytes. Unit 42: a transient webshell under the web-server account."},{"id":"shell","label":"Optional host follow-on","detail":"Unit 42 (7 Oct 2026): in-memory XMRig mining after the webshell. Third-party report, not a vendor confirmation."}]},"exploitation":{"kev":{"listed":false,"date":"2026-10-30","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","note":"Not in CISA KEV (checked 1 Nov 2026) against catalog 2026.10.30 (released 2026-10-30T17:02:45.3665Z, 1,766 entries). CVE-2026-90817 is not listed. The NVD record includes a CISA Coordinator SSVC option exploitation: none dated 21 Sep 2026; that is not a KEV listing."},"firstSeen":{"date":"2026-10-07","source":"Unit 42","note":"Reported exploited (Unit 42, 7 Oct 2026). Third-party. First calendar day of exploitation: not named. Vanderbilt has no public in-the-wild statement that we opened. Not in CISA KEV (checked 1 Nov 2026). This page records that as reported exploitation, not confirmed.","dateLabel":"Reported"},"vendorStatements":[]},"timeline":[{"date":"2026-09-20T12:05:32.698Z","event":"CVE.org published the Securifera CNA record for CVE-2026-90817 at 12:05 UTC. Affected: REDCap 13.3.0. Unaffected: 16.0.49, 17.3.10, and 17.4.4. Solution line names 16.0.49 LTS, 17.3.10 LTS, and 17.4.4 Standard Release. Requires a valid public survey hash; no authentication. CVSS 3.1 9.8. CWE-73 and CWE-94.","source":{"title":"CVE Record: CVE-2026-90817","url":"https://www.cve.org/CVERecord?id=CVE-2026-90817","publisher":"CVE / Securifera CNA"},"kind":"disclosure","key":true,"addedDate":"2026-11-01"},{"date":"2026-09-20T13:17:44.973Z","event":"NVD published CVE-2026-90817 at 13:17 UTC. Status when opened on 1 Nov 2026: Awaiting Analysis. CNA Securifera metric is CVSS 3.1 9.8. CWE-73 and CWE-94. Affected: REDCap 13.3.0 and higher. Requires a valid public survey hash; no authentication.","source":{"title":"NVD - CVE-2026-90817","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90817","publisher":"NVD"},"kind":"disclosure","key":true,"addedDate":"2026-11-01"},{"date":"2026-09-21T14:15:50.340719Z","event":"NVD republishes a CISA Coordinator SSVC option exploitation: none dated 21 Sep 2026 14:15 UTC. That predates the Unit 42 note and is not a KEV listing.","source":{"title":"NVD - CVE-2026-90817","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90817","publisher":"NVD"},"kind":"other","addedDate":"2026-11-01"},{"date":"2026-09-21T04:05:26Z","event":"GitHub repository murrez/CVE-2026-90817 was created. Description: unauthenticated REDCap RCE mass check PoC; requires a public survey hash. Independent validation: not verified. Index link only.","source":{"title":"murrez/CVE-2026-90817","url":"https://github.com/murrez/CVE-2026-90817","publisher":"murrez"},"kind":"poc","addedDate":"2026-11-01"},{"date":"2026-09-21T06:07:55Z","event":"GitHub repository ExDev994/CVE-2026-90817 was created. Independent validation: not verified. Index link only.","source":{"title":"ExDev994/CVE-2026-90817","url":"https://github.com/ExDev994/CVE-2026-90817","publisher":"ExDev994"},"kind":"poc","addedDate":"2026-11-01"},{"date":"2026-09-22","event":"IONIX published a threat-center note: REDCap 13.3.0 and later until the fixes; patched 16.0.49 LTS, 17.3.10 LTS, and 17.4.4 Standard Release (and later). CVSS 3.1 9.8. Public survey hash required.","source":{"title":"CVE-2026-90817 – Unauthenticated Remote Code Execution – REDCap","url":"https://www.ionix.io/threat-center/cve-2026-90817/","publisher":"IONIX"},"kind":"advisory","key":true,"addedDate":"2026-11-01"},{"date":"2026-09-22T19:44:01.280Z","event":"NVD last modified CVE-2026-90817 (19:44 UTC). Status Awaiting Analysis. Secondary CNA metric remains CVSS 3.1 9.8. CNA affected list still names 16.0.49, 17.3.10, and 17.4.4 as unaffected.","source":{"title":"NVD - CVE-2026-90817","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90817","publisher":"NVD"},"kind":"disclosure","addedDate":"2026-11-01"},{"date":"2026-09-24T07:39:38Z","event":"GitHub repository yulisec/CVE-2026-90817 was created. Independent validation: not verified. Index link only.","source":{"title":"yulisec/CVE-2026-90817","url":"https://github.com/yulisec/CVE-2026-90817","publisher":"yulisec"},"kind":"poc","addedDate":"2026-11-01"},{"date":"2026-09-26T01:27:59Z","event":"GitHub repository Farih123/CVE-2026-90817 was created. Independent validation: not verified. Index link only.","source":{"title":"Farih123/CVE-2026-90817","url":"https://github.com/Farih123/CVE-2026-90817","publisher":"Farih123"},"kind":"poc","addedDate":"2026-11-01"},{"date":"2026-09-27T20:19:02+00:00","event":"Securifera published Survey Says Remote Code Execution: CVE-2026-90817. Discoverer write-up. Public survey hash required. CVSS 3.1 9.8. This site does not republish exploit steps.","source":{"title":"Survey Says…. Remote Code Execution: CVE-2026-90817","url":"https://www.securifera.com/blog/2026/09/27/survey-says-remote-code-execution-cve-2026-90817/","publisher":"Securifera"},"kind":"poc","key":true,"addedDate":"2026-11-01"},{"date":"2026-10-01T15:34:52Z","event":"Securifera opened github.com/securifera/CVE-2026-90817 (REDCap DataImport RCE). Discoverer repository. Independent validation: not verified. Index link only.","source":{"title":"securifera/CVE-2026-90817","url":"https://github.com/securifera/CVE-2026-90817","publisher":"Securifera"},"kind":"poc","key":true,"addedDate":"2026-11-01"},{"date":"2026-10-07","event":"Unit 42 reported in-the-wild use: webshell via public survey endpoints, then fileless XMRig, at least four live workers. Relays a REDCap statement that after learning of the issue in September, a software update shipped within two days.","source":{"title":"2026-10-07 XMRig campaign through CVE-2026-90817","url":"https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-10-07-XMRig-campaign-through-CVE-2026-90817.txt","publisher":"Unit 42"},"kind":"reported","key":true,"addedDate":"2026-11-01"},{"date":"2026-10-16T13:23:10Z","event":"ctsit published a read-only passive scanner for CVE-2026-90817 (first commit 16 Oct 2026). Detection only. Not a public exploit listing.","source":{"title":"ctsit/redcap_cve_2026_90817_scan","url":"https://github.com/ctsit/redcap_cve_2026_90817_scan","publisher":"ctsit"},"kind":"other","addedDate":"2026-11-01"},{"date":"2026-10-30","event":"Not in CISA KEV. Catalog 2026.10.30 released 2026-10-30T17:02:45.3665Z (1,766 entries). Rechecked 1 Nov 2026. CVE-2026-90817 is not listed.","source":{"title":"CISA Known Exploited Vulnerabilities catalog","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","publisher":"CISA"},"kind":"other","addedDate":"2026-11-01"}],"openNotes":[{"title":"Fixed versions come from the CVE.org CNA record","detail":"A public Vanderbilt REDCap advisory was not opened. The CVE.org CNA record (Securifera, published 20 Sep 2026) names 13.3.0 as affected and 16.0.49, 17.3.10, and 17.4.4 as unaffected, and the solution line names 16.0.49 LTS, 17.3.10 LTS, and 17.4.4 Standard Release. IONIX (22 Sep 2026) restates those LTS/Standard builds. Confirm the exact build against your consortium release notes.","sources":[{"url":"https://www.cve.org/CVERecord?id=CVE-2026-90817","date":"2026-09-20","publisher":"CVE / Securifera CNA"},{"url":"https://www.ionix.io/threat-center/cve-2026-90817/","date":"2026-09-22","publisher":"IONIX"}]},{"title":"First calendar day of in-the-wild use is not named","detail":"Unit 42 (7 Oct 2026) reports active exploitation and at least four live workers. It does not name a first-seen calendar day. Vanderbilt has no public in-the-wild statement that we opened. Independent validation of in-the-wild use: not verified. This page records that as reported exploitation, not confirmed.","sources":[{"url":"https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-10-07-XMRig-campaign-through-CVE-2026-90817.txt","date":"2026-10-07","publisher":"Unit 42"}]},{"title":"Securifera advisories index lists this CVE","detail":"The Securifera advisories index, opened 1 Nov 2026, lists REDCap DataImport Remote Code Execution Vulnerability under CVE-2026-90817. That card links the CVE.org record. The same index page also links the 27 Sep 2026 write-up Survey Says Remote Code Execution: CVE-2026-90817. The NVD CNA reference is this index.","sources":[{"url":"https://www.securifera.com/advisories/","date":"2026-11-01","publisher":"Securifera"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-90817","date":"2026-09-20","publisher":"CVE / Securifera CNA"},{"url":"https://www.securifera.com/blog/2026/09/27/survey-says-remote-code-execution-cve-2026-90817/","date":"2026-09-27","publisher":"Securifera"}]}],"defenderActions":[{"title":"Inventory every REDCap host, version, and published public survey","detail":"Record product, version, and whether a live public survey hash exists. CVE.org and Securifera: no login is required, but a published public survey hash is. CVE.org: 13.3.0 and later until 16.0.49 LTS, 17.3.10 LTS, or 17.4.4 Standard.","priority":"now","links":[{"label":"CVE.org CVE-2026-90817","href":"https://www.cve.org/CVERecord?id=CVE-2026-90817"},{"label":"IONIX threat-center note","href":"https://www.ionix.io/threat-center/cve-2026-90817/"}]},{"title":"Upgrade to a listed fixed build","detail":"CVE.org: 16.0.49 LTS, 17.3.10 LTS, or 17.4.4 Standard, or a later build that includes the fix. A public Vanderbilt advisory was not opened. An upgrade does not replace review if a public survey was reachable while the host was affected.","priority":"now","links":[{"label":"IONIX threat-center note","href":"https://www.ionix.io/threat-center/cve-2026-90817/"}]},{"title":"If you cannot patch yet, restrict or disable public surveys","detail":"Securifera and IONIX: restrict or disable public surveys until the host is upgraded. Treat that as temporary containment, not a software fix.","priority":"now","links":[{"label":"Securifera write-up","href":"https://www.securifera.com/blog/2026/09/27/survey-says-remote-code-execution-cve-2026-90817/"},{"label":"IONIX threat-center note","href":"https://www.ionix.io/threat-center/cve-2026-90817/"}]},{"title":"If a public survey was reachable, hunt Unit 42 artefacts","detail":"Review web access logs for survey requests that also name a passthrough parameter and a DataImportController route. Review EDR for the web-server user spawning bash. Review new files under the REDCap temp/cache directory. Review outbound mining-pool traffic. Copy Unit 42 indicators only. Do not send crafted requests.","priority":"now","links":[{"label":"Unit 42 note","href":"https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-10-07-XMRig-campaign-through-CVE-2026-90817.txt"}]}],"detection":[{"title":"Survey requests that name a passthrough parameter and DataImportController","detail":"Unit 42: exploitation attempts used an unauthenticated HTTP POST through a public survey hash, a passthrough parameter, and a DataImportController route. ctsit: a passthrough parameter or route= alone is legitimate REDCap traffic; treat a survey request that reaches DataImportController as exploit-shaped. Hunt access logs. Do not send crafted requests. A hit is a lead, not proof of code execution.","logSource":"Web-server / reverse-proxy HTTP access logs for /surveys","kind":"generic","group":"web-proxy","url":"https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-10-07-XMRig-campaign-through-CVE-2026-90817.txt","date":"2026-10-07"},{"title":"Encoded passthrough or ParcelController on a public survey","detail":"Securifera (27 Sep 2026): hunt encoded passthrough values and survey requests that name DataImportController:index or ParcelController:show. ctsit: a plain passthrough parameter or route= alone is legitimate; a double-encoded passthrough that reaches an internal controller is exploit-shaped. Hunt access logs. Do not send crafted requests. A hit is a lead, not proof of code execution.","logSource":"Web-server / reverse-proxy HTTP access logs for /surveys","kind":"generic","group":"web-proxy","url":"https://www.securifera.com/blog/2026/09/27/survey-says-remote-code-execution-cve-2026-90817/","date":"2026-09-27"},{"title":"ProjectDiscovery Nuclei check CVE-2026-90817.yaml","detail":"ProjectDiscovery publishes http/cves/2026/CVE-2026-90817.yaml. Checked 1 Nov 2026. Metadata marks verified: true; that is their check mark, not a vuln2shell PoC validation. Detection only. This site does not copy the request path or treat the YAML as a public exploit listing.","logSource":"ProjectDiscovery Nuclei CVE-2026-90817.yaml (scanner output against your own hosts)","kind":"generic","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-90817.yaml","date":"2026-11-01","dateKind":"checked"},{"title":"ctsit read-only passive scanner","detail":"ctsit/redcap_cve_2026_90817_scan (created 16 Oct 2026) is a read-only host scanner. It never sends HTTP and never reproduces the issue. It compares the installed redcap_vX.Y.Z directory to the patched releases and hunts Unit 42 indicators in local logs, files, processes, sockets, cron, and SSH keys. Extra IPs named from one operator's logs are not copied here.","logSource":"Local REDCap host: web logs, temp/cache, process list, sockets, cron, authorized_keys","kind":"generic","group":"edr","url":"https://github.com/ctsit/redcap_cve_2026_90817_scan","date":"2026-10-16"},{"title":"EDR: web-server user spawning bash","detail":"Unit 42: a successful run staged a transient webshell, then a Base64-encoded bash cradle in memory under web-server permissions. Hunt the PHP or web-server account spawning bash or unusual child shells. Presence of a shell is a lead, not proof of this CVE.","logSource":"EDR / process-creation logs for the PHP or web-server account","kind":"generic","group":"edr","url":"https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-10-07-XMRig-campaign-through-CVE-2026-90817.txt","date":"2026-10-07"},{"title":"New files under the REDCap temp/cache directory","detail":"Unit 42 names one dropped webshell path under /var/www/html/redcap/temp/cache/ ending in .bladec. ctsit: the .bladec suffix is normal BladeOne output, so do not flag the extension alone; hunt unexpected new files and the Unit 42 SHA-256. Default install roots vary.","logSource":"REDCap host filesystem under temp/cache (mtime/ctime and hashes)","kind":"generic","group":"edr","url":"https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-10-07-XMRig-campaign-through-CVE-2026-90817.txt","date":"2026-10-07"},{"title":"Outbound traffic to a mining pool","detail":"Unit 42: the campaign deployed XMRig and used pool-wallet telemetry to count at least four live workers. Hunt outbound mining-pool connections and the Unit 42 wallet string. No extra pool hostnames are indexed beyond that note.","logSource":"Firewall / DNS / proxy logs for outbound mining-pool traffic","kind":"generic","url":"https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-10-07-XMRig-campaign-through-CVE-2026-90817.txt","date":"2026-10-07"}],"detectionRules":[{"id":"v2s-sigma-redcap-cve-2026-90817-web","title":"REDCap CVE-2026-90817 survey-passthrough hunt","language":"sigma","query":"title: REDCap CVE-2026-90817 survey-passthrough hunt\nid: 7c2e9a14-5b8f-4d31-9e06-3a1c0d84f2b7\nstatus: experimental\ndescription: Detects the Unit 42-named attacker IP, a double-encoded passthrough value, or a public-survey request that also names a passthrough parameter and DataImportController or ParcelController. Request hunt only. Not a payload detector.\nreferences:\n    - https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-10-07-XMRig-campaign-through-CVE-2026-90817.txt\n    - https://www.securifera.com/blog/2026/09/27/survey-says-remote-code-execution-cve-2026-90817/\n    - https://github.com/ctsit/redcap_cve_2026_90817_scan\nauthor: vuln2shell\ndate: 2026-11-01\nlogsource:\n    category: webserver\ndetection:\n    selection_ip:\n        c-ip:\n            - '202.61.130.221'\n    selection_encoded:\n        cs-uri-query|contains:\n            - '%2569ndex.php'\n    selection_survey:\n        cs-uri-stem|contains: 'surveys'\n    selection_passthru:\n        cs-uri-query|contains: 'passthru'\n    selection_import:\n        cs-uri-query|contains: 'DataImportController'\n    selection_parcel:\n        cs-uri-query|contains: 'ParcelController'\n    condition: selection_ip or selection_encoded or (selection_survey and selection_passthru and selection_import) or (selection_survey and selection_passthru and selection_parcel)\nfalsepositives:\n    - Legitimate survey traffic that names a passthrough parameter without the encoded value or those controllers\nlevel: high","logSource":"Web-server / reverse-proxy HTTP access logs for /surveys","author":"vuln2shell after Unit 42, Securifera, and ctsit","authorUrl":"https://vuln2shell.com","sourceUrl":"https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-10-07-XMRig-campaign-through-CVE-2026-90817.txt","sourceDate":"2026-10-07","license":"CC0 1.0","origin":"vuln2shell","notes":"vuln2shell hunt from Unit 42 IOCs plus the Securifera/ctsit encoded-passthrough and ParcelController context. A request is not proof of compromise. Tune field names to your shipper.","tested":"untested"},{"id":"v2s-spl-redcap-cve-2026-90817-web","title":"REDCap CVE-2026-90817 survey-passthrough hunt (SPL)","language":"spl","query":"index=* (sourcetype=access_combined OR sourcetype=nginx:plus:access OR sourcetype=aws:waf:logs)\n(\"202.61.130.221\" OR \"%2569ndex.php\" OR (\"surveys\" AND \"passthru\" AND (\"DataImportController\" OR \"ParcelController\")))\n| stats count min(_time) as firstTime max(_time) as lastTime values(clientip) as src by host, sourcetype\n| convert ctime(firstTime) ctime(lastTime)","logSource":"Web-server / reverse-proxy HTTP access logs","author":"vuln2shell after Unit 42, Securifera, and ctsit","authorUrl":"https://vuln2shell.com","sourceUrl":"https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-10-07-XMRig-campaign-through-CVE-2026-90817.txt","sourceDate":"2026-10-07","license":"CC0 1.0","origin":"vuln2shell","notes":"Web-log hunt only. Host paths such as syslog-a224be51 belong on file or EDR telemetry. Tune sourcetype.","tested":"untested"},{"id":"v2s-kql-redcap-cve-2026-90817-web","title":"REDCap CVE-2026-90817 survey-passthrough hunt (KQL)","language":"kql","query":"union isfuzzy=true CommonSecurityLog, W3CIISLog\n| where TimeGenerated > ago(14d)\n| where * has \"202.61.130.221\"\n    or * has \"%2569ndex.php\"\n    or (* has \"surveys\" and * has \"passthru\" and (* has \"DataImportController\" or * has \"ParcelController\"))\n| summarize count(), min(TimeGenerated), max(TimeGenerated) by Computer, Type\n| order by count_ desc","logSource":"Web-server / reverse-proxy logs shipped to Microsoft Sentinel","author":"vuln2shell after Unit 42, Securifera, and ctsit","authorUrl":"https://vuln2shell.com","sourceUrl":"https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-10-07-XMRig-campaign-through-CVE-2026-90817.txt","sourceDate":"2026-10-07","license":"CC0 1.0","origin":"vuln2shell","notes":"Web-log hunt only. Table and field names vary by parser. Host-path strings are not in this query.","tested":"untested"},{"id":"v2s-esql-redcap-cve-2026-90817-web","title":"REDCap CVE-2026-90817 survey-passthrough hunt (ES|QL)","language":"esql","query":"FROM logs-*\n| WHERE source.ip == \"202.61.130.221\" OR url.query LIKE \"*%2569ndex.php*\" OR (url.path LIKE \"*surveys*\" AND url.query LIKE \"*passthru*\" AND (url.query LIKE \"*DataImportController*\" OR url.query LIKE \"*ParcelController*\"))\n| STATS count = COUNT(*), first = MIN(@timestamp), last = MAX(@timestamp) BY host.name, source.ip","logSource":"Web-server / reverse-proxy logs shipped to Elastic","author":"vuln2shell after Unit 42, Securifera, and ctsit","authorUrl":"https://vuln2shell.com","sourceUrl":"https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-10-07-XMRig-campaign-through-CVE-2026-90817.txt","sourceDate":"2026-10-07","license":"CC0 1.0","origin":"vuln2shell","notes":"Web-log hunt only. Index and field names vary by ingest pipeline. Host-path strings are not in this query.","tested":"untested"},{"id":"v2s-suricata-redcap-cve-2026-90817-web","title":"REDCap CVE-2026-90817 survey-passthrough hunt (Suricata)","language":"suricata","query":"alert http any any -> any any (msg:\"VULN2SHELL REDCap CVE-2026-90817 survey-passthrough hunt\"; flow:established,to_server; http.uri; content:\"surveys\"; nocase; pcre:\"/(__)?passthru/i\"; pcre:\"/DataImportController|ParcelController|%2569ndex\\.php/i\"; classtype:web-application-attack; sid:1908171; rev:2;)","logSource":"IDS / IPS in front of REDCap","author":"vuln2shell after Securifera and ctsit","authorUrl":"https://vuln2shell.com","sourceUrl":"https://www.securifera.com/blog/2026/09/27/survey-says-remote-code-execution-cve-2026-90817/","sourceDate":"2026-09-27","license":"CC0 1.0","origin":"vuln2shell","notes":"Local sid 1908171 rev 2. Requires a public-survey URI plus a passthrough parameter, then DataImportController, ParcelController, or the ctsit-named double-encoded index token. DataImportController alone does not match.","tested":"untested"},{"id":"v2s-yara-redcap-cve-2026-90817-host","title":"REDCap CVE-2026-90817 host-path strings (YARA)","language":"yara","query":"rule V2S_REDCap_CVE_2026_90817_host_paths {\n  meta:\n    author = \"vuln2shell\"\n    source = \"Unit 42 2026-10-07 XMRig campaign note\"\n  strings:\n    $webshell = \"d3f11fc8ee9c2d986425eff26ecace5b4004eb8e.bladec\" ascii\n    $stage = \"/var/tmp/.syslog-a224be51/xmrig.tar.gz\" ascii\n  condition:\n    any of them\n}","logSource":"Forensic image or file scan of the REDCap host","author":"vuln2shell after Unit 42","authorUrl":"https://vuln2shell.com","sourceUrl":"https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-10-07-XMRig-campaign-through-CVE-2026-90817.txt","sourceDate":"2026-10-07","license":"CC0 1.0","origin":"vuln2shell","notes":"File-scan hunt for two Unit 42 INDICATORS paths. Actor tooling can rotate. Untested.","tested":"untested"}],"detectionLinks":[{"title":"Unit 42 XMRig campaign through CVE-2026-90817","url":"https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-10-07-XMRig-campaign-through-CVE-2026-90817.txt","author":"Nithin Chenthur Prabhu, Somil Tyagi, Alex Payne (Unit 42)","date":"2026-10-07","note":"Log source: web access logs, EDR, temp/cache, and outbound mining-pool traffic. Public hunt note and INDICATORS. This site copies only those indicators. This site does not republish exploit code."},{"title":"ProjectDiscovery Nuclei CVE-2026-90817.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-90817.yaml","author":"sudo-a-man / ProjectDiscovery","date":"2026-11-01","note":"Log source: Nuclei scanner output against your own hosts. Detection YAML. Date is a checked date (1 Nov 2026). Metadata verified: true is their mark. Not listed under /pocs."},{"title":"ctsit REDCap CVE-2026-90817 passive scanner","url":"https://github.com/ctsit/redcap_cve_2026_90817_scan","author":"ctsit","date":"2026-10-16","note":"Log source: local REDCap host web logs, temp/cache, process list, sockets, cron, and authorized_keys. Read-only host scanner. Detection only. Not listed under /pocs. A passthrough parameter alone is legitimate. The .bladec suffix is normal BladeOne output."},{"title":"Securifera write-up (encoded passthrough hunt)","url":"https://www.securifera.com/blog/2026/09/27/survey-says-remote-code-execution-cve-2026-90817/","author":"b0yd, Securifera","date":"2026-09-27","note":"Log source: web-server / reverse-proxy HTTP access logs for /surveys. Discoverer hunt list: encoded passthrough values and survey requests to DataImportController:index or ParcelController:show."}],"retrohunt":{"summary":"If a REDCap host published a public survey from 20 Sep 2026, hunt web logs for survey requests that also name DataImportController, then host files and processes against the Unit 42 INDICATORS. First calendar day of exploitation: not named.","lookback":{"from":"2026-09-20","basis":"public-disclosure","rationale":"NVD published CVE-2026-90817 on 20 Sep 2026. Unit 42 reported in-the-wild use on 7 Oct 2026 and did not name a first-exploitation calendar day. Hunt from the public disclosure.","sources":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90817","date":"2026-09-20","publisher":"NVD"},{"url":"https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-10-07-XMRig-campaign-through-CVE-2026-90817.txt","date":"2026-10-07","publisher":"Unit 42"}]},"logSources":[{"name":"Web-server / reverse-proxy HTTP access logs for /surveys","why":"Unit 42: survey requests with a passthrough parameter and a DataImportController route. See Detection for the ctsit caveat.","required":true},{"name":"REDCap host filesystem under temp/cache","why":"Unit 42 names one dropped webshell path under temp/cache. See Detection for the ctsit .bladec caveat.","required":true},{"name":"EDR / process-creation logs for the PHP or web-server account","why":"Unit 42: bash cradle in memory under web-server permissions, then XMRig.","required":false},{"name":"Firewall / DNS / proxy logs for outbound mining-pool traffic","why":"Unit 42 used pool-wallet telemetry to count at least four live workers.","required":false}],"steps":[{"title":"List survey requests that also name DataImportController since 20 Sep 2026","detail":"Search access logs for /surveys requests that also name DataImportController. A hit is a lead, not proof. Do not send crafted requests. See Detection for the ctsit scanner.","sources":[{"url":"https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-10-07-XMRig-campaign-through-CVE-2026-90817.txt","date":"2026-10-07","publisher":"Unit 42"}]},{"title":"Compare temp/cache files to the Unit 42 SHA-256 and path","detail":"Hunt d3f11fc8ee9c2d986425eff26ecace5b4004eb8e.bladec and hash 39a435123dc1fffd499aa2acf11ef46e3ee2e805bf137811af0c2c5b12546920. See Detection for the ctsit .bladec caveat.","sources":[{"url":"https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-10-07-XMRig-campaign-through-CVE-2026-90817.txt","date":"2026-10-07","publisher":"Unit 42"}]},{"title":"Review miner staging and the documented attacker IP","detail":"Hunt /var/tmp/.syslog-a224be51/xmrig.tar.gz and source IP 202.61.130.221. Extra IPs from one operator's scanner notes are not copied here.","sources":[{"url":"https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-10-07-XMRig-campaign-through-CVE-2026-90817.txt","date":"2026-10-07","publisher":"Unit 42"}]}],"queries":[{"id":"v2s-spl-redcap-cve-2026-90817-retrohunt-web","title":"REDCap CVE-2026-90817 survey-passthrough hunt since 20 Sep 2026","language":"spl","query":"index=* (\"202.61.130.221\" OR \"%2569ndex.php\" OR (\"surveys\" AND \"passthru\" AND (\"DataImportController\" OR \"ParcelController\"))) earliest=09/20/2026:00:00:00\n| stats count min(_time) as firstTime max(_time) as lastTime values(clientip) as src by host, sourcetype\n| convert ctime(firstTime) ctime(lastTime)","logSource":"Web-server / reverse-proxy HTTP access logs","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-10-07-XMRig-campaign-through-CVE-2026-90817.txt","sourceDate":"2026-10-07","license":"CC0 1.0","origin":"vuln2shell","notes":"Web-log lookback from the CVE.org publication day. Host paths are in the file/EDR query.","tested":"untested","timeRange":"From 20 Sep 2026 (CVE.org publication) through the last patch window"},{"id":"v2s-spl-redcap-cve-2026-90817-retrohunt-host","title":"REDCap CVE-2026-90817 host-path hunt since 20 Sep 2026","language":"spl","query":"index=* (\"d3f11fc8ee9c2d986425eff26ecace5b4004eb8e.bladec\" OR \"syslog-a224be51\" OR \"39a435123dc1fffd499aa2acf11ef46e3ee2e805bf137811af0c2c5b12546920\") earliest=09/20/2026:00:00:00\n| stats count min(_time) as firstTime max(_time) as lastTime values(file_path) as path by host, sourcetype\n| convert ctime(firstTime) ctime(lastTime)","logSource":"EDR / file-integrity / filesystem audit for temp/cache and /var/tmp","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-10-07-XMRig-campaign-through-CVE-2026-90817.txt","sourceDate":"2026-10-07","license":"CC0 1.0","origin":"vuln2shell","notes":"Host-path hunt from Unit 42 INDICATORS. Do not run these strings against web access logs.","tested":"untested","timeRange":"From 20 Sep 2026 (CVE.org publication) through the last patch window"}],"artefacts":[{"kind":"file","value":"/var/www/html/redcap/temp/cache/d3f11fc8ee9c2d986425eff26ecace5b4004eb8e.bladec","detail":"Unit 42 INDICATORS: path for dropped web shell file. Install roots vary.","sourceUrl":"https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-10-07-XMRig-campaign-through-CVE-2026-90817.txt","sourceDate":"2026-10-07"},{"kind":"file","value":"/var/tmp/.syslog-a224be51/xmrig.tar.gz","detail":"Unit 42 INDICATORS: path for staged cryptocurrency miner archive.","sourceUrl":"https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-10-07-XMRig-campaign-through-CVE-2026-90817.txt","sourceDate":"2026-10-07"},{"kind":"network","value":"202.61.130.221","detail":"Unit 42 INDICATORS: attacker IP address (exploit source). Written 202.61.130[.]221 in the note.","sourceUrl":"https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-10-07-XMRig-campaign-through-CVE-2026-90817.txt","sourceDate":"2026-10-07"},{"kind":"report","value":"87maYgt7bMvgDxQsBavYNVDr6BQgJNaaRKXg2yBh8A3GLVoizCq9eeycBT7v6kdnm8f41Vfz84x6XLeEUJDRqvYbSrhvzTw","detail":"Unit 42 INDICATORS: address for attacker's XMRig wallet (used by active worker fleet). Copied exactly. No matching structured IOC type on this site.","sourceUrl":"https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-10-07-XMRig-campaign-through-CVE-2026-90817.txt","sourceDate":"2026-10-07"}],"iocs":[{"type":"ip","value":"202.61.130.221","context":"Unit 42 INDICATORS: Attacker IP address (exploit source). Written 202.61.130[.]221 in the note.","sourceUrl":"https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-10-07-XMRig-campaign-through-CVE-2026-90817.txt","sourceDate":"2026-10-07"},{"type":"hash","value":"39a435123dc1fffd499aa2acf11ef46e3ee2e805bf137811af0c2c5b12546920","context":"Unit 42 INDICATORS: SHA-256 hash for secondary stage payload script (dropper for cryptocurrency miner).","sourceUrl":"https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-10-07-XMRig-campaign-through-CVE-2026-90817.txt","sourceDate":"2026-10-07"},{"type":"path","value":"/var/www/html/redcap/temp/cache/d3f11fc8ee9c2d986425eff26ecace5b4004eb8e.bladec","context":"Unit 42 INDICATORS: Path for dropped web shell file.","sourceUrl":"https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-10-07-XMRig-campaign-through-CVE-2026-90817.txt","sourceDate":"2026-10-07"},{"type":"path","value":"/var/tmp/.syslog-a224be51/xmrig.tar.gz","context":"Unit 42 INDICATORS: Path for staged cryptocurrency miner archive.","sourceUrl":"https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-10-07-XMRig-campaign-through-CVE-2026-90817.txt","sourceDate":"2026-10-07"}],"iocNote":"Copied exactly from the Unit 42 INDICATORS list dated 7 Oct 2026. The fifth INDICATORS item is the XMRig wallet 87maYgt7bMvgDxQsBavYNVDr6BQgJNaaRKXg2yBh8A3GLVoizCq9eeycBT7v6kdnm8f41Vfz84x6XLeEUJDRqvYbSrhvzTw (no matching structured IOC type on this site; listed as an artefact). Extra IPs from one operator's scanner notes are not copied. Do not invent IPs, hashes, or user-agents.","hitMeaning":[{"level":"attempt","detail":"A survey request that names DataImportController, or traffic from 202.61.130.221, with no matching host artefact."},{"level":"likely-compromise","detail":"A Unit 42-named file or hash on a host that published a public survey while on 13.3.0 or later without a listed fix."},{"level":"compromise","detail":"Evidence that attacker-controlled code ran on the REDCap host. Unit 42 is a third-party report. Independent validation: not verified. This page records that as reported exploitation, not confirmed.","label":"Compromise (your evidence)"}],"nextSteps":[{"title":"Upgrade to a listed fixed build and restrict public surveys until you can","detail":"CVE.org CNA record: 16.0.49 LTS, 17.3.10 LTS, or 17.4.4 Standard. Securifera and IONIX: restrict or disable public surveys until then.","links":[{"label":"IONIX threat-center note","href":"https://www.ionix.io/threat-center/cve-2026-90817/"}]},{"title":"Preserve copies and hashes of temp/cache files before restore","detail":"Keep the Unit 42-named path and any unexpected new files under temp/cache, plus their hashes, before upgrade or restore overwrites them.","links":[{"label":"Unit 42 note","href":"https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-10-07-XMRig-campaign-through-CVE-2026-90817.txt"}]}],"limits":["Unit 42 did not name a first calendar day of exploitation.","A public Vanderbilt advisory was not opened.","See Detection for the ctsit caveat on the .bladec suffix.","Extra IPs from one operator's scanner notes are not copied."],"sources":[{"url":"https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-10-07-XMRig-campaign-through-CVE-2026-90817.txt","date":"2026-10-07","publisher":"Unit 42"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90817","date":"2026-09-20","publisher":"NVD"}],"updatedAt":"2026-11-01"},"amIAffected":{"summary":"The CVE.org CNA record names REDCap 13.3.0 and later as affected until 16.0.49 LTS, 17.3.10 LTS, or 17.4.4 Standard. A published public survey hash is a precondition. A public Vanderbilt advisory was not opened.","checks":[{"id":"v2s-aia-redcap-cve-2026-90817-version-1","kind":"version","title":"Record the installed REDCap version against the CVE.org CNA fixed builds","detail":"CVE.org and IONIX: 13.3.0 and later are affected until 16.0.49, 17.3.10, or 17.4.4. No public CLI version string was copied from a Vanderbilt advisory in this pass. See Detection for the ctsit host version check.","command":"Record the installed REDCap version from the redcap_vX.Y.Z directory name on the host, or from the product's own version display, and compare it to 16.0.49 LTS, 17.3.10 LTS, and 17.4.4 Standard.","affectedMeans":"The installed version is 13.3.0 or later and is not 16.0.49 LTS, 17.3.10 LTS, 17.4.4 Standard, or a later build that includes the fix.","fixedMeans":"The installed version is 16.0.49 LTS, 17.3.10 LTS, 17.4.4 Standard, or a later build that includes the fix.","notes":"This is inventory only. Fixed builds come from the CVE.org CNA record. Do not send crafted requests.","sources":[{"url":"https://www.cve.org/CVERecord?id=CVE-2026-90817","date":"2026-09-20","publisher":"CVE / Securifera CNA"},{"url":"https://www.ionix.io/threat-center/cve-2026-90817/","date":"2026-09-22","publisher":"IONIX"}]},{"id":"v2s-aia-redcap-cve-2026-90817-config-2","kind":"config","title":"Record whether a published public survey hash exists","detail":"NVD and Securifera: exploitation requires knowledge of a valid public survey hash. On each host, record whether any project has a live published public survey (the s= parameter). Do not collect or publish those hashes.","command":"On each REDCap host, record whether any project has a live published public survey. Do not probe the survey URL with extra parameters.","affectedMeans":"An affected version is installed and at least one public survey is published.","fixedMeans":"No public survey is published, or the host is on a listed fixed build.","notes":"A published survey is a precondition, not proof of compromise.","sources":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90817","date":"2026-09-22","publisher":"NVD"},{"url":"https://www.securifera.com/blog/2026/09/27/survey-says-remote-code-execution-cve-2026-90817/","date":"2026-09-27","publisher":"Securifera"}]},{"id":"v2s-aia-redcap-cve-2026-90817-exposure-3","kind":"exposure","title":"Scoped product-fingerprint search for your own ranges","detail":"Scoped Shodan title search for REDCap in your own ranges. Product fingerprint only, not a vulnerable count. See Detection for the Nuclei metadata source.","command":"shodan search 'http.title:\"REDCap\" net:<your-range>'","affectedMeans":"A host in your range matches the REDCap title fingerprint and is on 13.3.0 or later without a listed fix, with a published public survey.","fixedMeans":"No matching host in your range, or every match is on a listed fixed build or has no published public survey.","notes":"Fingerprint only. Do not treat a title hit as proof of this CVE.","sources":[{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-90817.yaml","date":"2026-11-01","publisher":"ProjectDiscovery"}]}],"limits":["A public Vanderbilt advisory was not opened.","Fixed builds come from the CVE.org CNA record (Securifera). IONIX restates the same LTS/Standard builds.","The Shodan fingerprint is a product title match, not a vendor inventory command.","Do not invent extra internet-search queries."],"sources":[{"url":"https://www.cve.org/CVERecord?id=CVE-2026-90817","date":"2026-09-20","publisher":"CVE / Securifera CNA"},{"url":"https://www.ionix.io/threat-center/cve-2026-90817/","date":"2026-09-22","publisher":"IONIX"}],"updatedAt":"2026-11-01","addedDate":"2026-11-01"},"mitigations":{"summary":"Securifera and IONIX document a workaround: restrict or disable public surveys until the host is upgraded. That is not a vendor advisory. The software fix is a listed fixed build.","items":[{"title":"Restrict or disable public surveys","detail":"Securifera (27 Sep 2026): if an immediate upgrade is not possible, restrict or disable public surveys. IONIX (22 Sep 2026) repeats the same step. This reduces exposure of the survey-hash precondition.","limits":"Not a software fix. Still upgrade to 16.0.49 LTS, 17.3.10 LTS, or 17.4.4 Standard. Disabling public surveys can interrupt legitimate data collection. A public Vanderbilt workaround list was not opened.","verify":"No live public survey remains published on the host, or untrusted networks can no longer complete HTTPS to /surveys. Confirm in the product survey list and the edge firewall, then re-check after the next change window. Do not send crafted requests.","source":{"url":"https://www.securifera.com/blog/2026/09/27/survey-says-remote-code-execution-cve-2026-90817/","date":"2026-09-27","publisher":"Securifera"}}],"updatedAt":"2026-11-01","addedDate":"2026-11-01"},"response":{"summary":"Upgrade to a listed fixed build and restrict public surveys until you can. If a public survey was reachable while the host was affected, preserve web logs and temp/cache files, then hunt the Unit 42 INDICATORS. No vendor persistence bulletin was opened.","containment":[{"title":"Restrict or disable public surveys if you cannot patch immediately","detail":"Securifera and IONIX: restrict or disable public surveys until the host is upgraded.","sources":[{"url":"https://www.securifera.com/blog/2026/09/27/survey-says-remote-code-execution-cve-2026-90817/","date":"2026-09-27","publisher":"Securifera"},{"url":"https://www.ionix.io/threat-center/cve-2026-90817/","date":"2026-09-22","publisher":"IONIX"}]},{"title":"Upgrade REDCap to a listed fixed build","detail":"CVE.org CNA record: 16.0.49 LTS, 17.3.10 LTS, or 17.4.4 Standard. An upgrade does not replace review of logs and temp/cache from the affected period.","sources":[{"url":"https://www.cve.org/CVERecord?id=CVE-2026-90817","date":"2026-09-20","publisher":"CVE / Securifera CNA"},{"url":"https://www.ionix.io/threat-center/cve-2026-90817/","date":"2026-09-22","publisher":"IONIX"}]},{"title":"Hunt Unit 42 INDICATORS before trusting the host","detail":"Review the four structured INDICATORS (attacker IP, dropper SHA-256, webshell path, miner archive path) and the wallet string listed as an artefact. Third-party report. Independent validation: not verified.","sources":[{"url":"https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-10-07-XMRig-campaign-through-CVE-2026-90817.txt","date":"2026-10-07","publisher":"Unit 42"}]}],"rotate":[{"item":"Credentials, API keys, and secrets the REDCap web process could reach","reason":"General: if unauthenticated code execution succeeded, treat secrets on or behind the host as exposed. No CVE-2026-90817-specific rotate list was published in the sources we opened.","generic":true,"sources":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90817","date":"2026-09-22","publisher":"NVD"}]}],"persistence":[{"kind":"path","value":"/var/www/html/redcap/temp/cache/d3f11fc8ee9c2d986425eff26ecace5b4004eb8e.bladec","detail":"Unit 42 INDICATORS: path for dropped web shell file. Install roots vary. See Detection for the ctsit .bladec caveat.","sourceUrl":"https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-10-07-XMRig-campaign-through-CVE-2026-90817.txt","sourceDate":"2026-10-07"},{"kind":"path","value":"/var/tmp/.syslog-a224be51/xmrig.tar.gz","detail":"Unit 42 INDICATORS: path for staged cryptocurrency miner archive.","sourceUrl":"https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-10-07-XMRig-campaign-through-CVE-2026-90817.txt","sourceDate":"2026-10-07"}],"observedBehaviour":[{"title":"Webshell then fileless XMRig","detail":"Unit 42: a transient webshell under the web-server account, then an in-memory bash cradle that fetched a secondary payload and deployed XMRig. At least four live workers on pool data.","sourceUrl":"https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-10-07-XMRig-campaign-through-CVE-2026-90817.txt","sourceDate":"2026-10-07"}],"evidence":[{"title":"Installed REDCap version string from before the upgrade","detail":"Preserve the redcap_vX.Y.Z directory name or the product version display so you can show whether the host was 13.3.0 or later while a public survey was published.","sources":[{"url":"https://www.cve.org/CVERecord?id=CVE-2026-90817","date":"2026-09-20","publisher":"CVE / Securifera CNA"}]},{"title":"Web access logs for /surveys from 20 Sep 2026","detail":"Keep survey requests that also name DataImportController. No extra attacker IPs beyond the Unit 42 INDICATORS list.","sources":[{"url":"https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-10-07-XMRig-campaign-through-CVE-2026-90817.txt","date":"2026-10-07","publisher":"Unit 42"}]},{"title":"Copies and hashes of unexpected temp/cache files","detail":"Keep the Unit 42-named path and any unexpected new files under temp/cache, plus SHA-256 hashes, from 20 Sep 2026 onward before restore or upgrade.","sources":[{"url":"https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-10-07-XMRig-campaign-through-CVE-2026-90817.txt","date":"2026-10-07","publisher":"Unit 42"}]}],"limits":["Unit 42 did not name a first calendar day of exploitation.","A public Vanderbilt advisory was not opened.","See Detection for the ctsit caveat on the .bladec suffix.","Extra IPs from one operator's scanner notes are not copied.","In-the-wild use is reported (Unit 42, 7 Oct 2026), not confirmed. Not in CISA KEV (checked 1 Nov 2026)."],"sources":[{"url":"https://www.cve.org/CVERecord?id=CVE-2026-90817","date":"2026-09-20","publisher":"CVE / Securifera CNA"},{"url":"https://www.ionix.io/threat-center/cve-2026-90817/","date":"2026-09-22","publisher":"IONIX"},{"url":"https://www.securifera.com/blog/2026/09/27/survey-says-remote-code-execution-cve-2026-90817/","date":"2026-09-27","publisher":"Securifera"},{"url":"https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-10-07-XMRig-campaign-through-CVE-2026-90817.txt","date":"2026-10-07","publisher":"Unit 42"}],"updatedAt":"2026-11-01","addedDate":"2026-11-01"},"bulletins":[],"coverage":[{"title":"CVE Record: CVE-2026-90817","publisher":"CVE / Securifera CNA","url":"https://www.cve.org/CVERecord?id=CVE-2026-90817","date":"2026-09-20","type":"research","addedDate":"2026-11-01"},{"title":"NVD CVE-2026-90817","publisher":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90817","date":"2026-09-20","type":"government","addedDate":"2026-11-01"},{"title":"CVE-2026-90817 – Unauthenticated Remote Code Execution – REDCap","publisher":"IONIX","url":"https://www.ionix.io/threat-center/cve-2026-90817/","date":"2026-09-22","type":"news","addedDate":"2026-11-01"},{"title":"Survey Says…. Remote Code Execution: CVE-2026-90817","publisher":"Securifera","url":"https://www.securifera.com/blog/2026/09/27/survey-says-remote-code-execution-cve-2026-90817/","date":"2026-09-27","type":"research","addedDate":"2026-11-01"},{"title":"2026-10-07 XMRig campaign through CVE-2026-90817","publisher":"Unit 42","url":"https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-10-07-XMRig-campaign-through-CVE-2026-90817.txt","date":"2026-10-07","type":"research","addedDate":"2026-11-01"},{"title":"CISA KEV catalog JSON (CVE-2026-90817 not listed; catalog 2026.10.30)","publisher":"CISA","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-10-30","type":"government","addedDate":"2026-11-01"}],"posts":[],"research":[{"title":"CVE Record: CVE-2026-90817 (Securifera CNA; affected and fixed builds)","url":"https://www.cve.org/CVERecord?id=CVE-2026-90817","authors":"Securifera CNA (Ryan Wincey)","date":"published 20 Sep 2026 12:05 UTC, updated 21 Sep 2026, checked 1 Nov 2026"},{"title":"Survey Says…. Remote Code Execution: CVE-2026-90817","url":"https://www.securifera.com/blog/2026/09/27/survey-says-remote-code-execution-cve-2026-90817/","authors":"b0yd, Securifera","date":"27 Sep 2026, 20:19 UTC"},{"title":"securifera/CVE-2026-90817 (discoverer repository)","url":"https://github.com/securifera/CVE-2026-90817","authors":"Securifera","date":"1 Oct 2026, 15:34 UTC"},{"title":"2026-10-07 XMRig campaign through CVE-2026-90817","url":"https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-10-07-XMRig-campaign-through-CVE-2026-90817.txt","authors":"Nithin Chenthur Prabhu, Somil Tyagi, Alex Payne (Unit 42)","date":"7 Oct 2026"},{"title":"NVD CVE-2026-90817 (republishes CNA; Awaiting Analysis)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90817","authors":"NVD / Securifera CNA","date":"published 20 Sep 2026, lastModified 22 Sep 2026, checked 1 Nov 2026"},{"title":"CISA KEV catalog JSON (CVE-2026-90817 not listed; catalog 2026.10.30)","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","authors":"CISA","date":"catalog 2026.10.30, checked 1 Nov 2026"}],"impact":{"kind":"single-product","product":"Vanderbilt REDCap","versions":[{"version":"REDCap 13.3.0 and later, until a listed fix","status":"affected","versions":"16.0.49 / 17.3.10 / 17.4.4","vendorStatement":{"date":"2026-09-20","url":"https://www.cve.org/CVERecord?id=CVE-2026-90817","quote":"Upgrade to REDCap 16.0.49 LTS, 17.3.10 LTS, or 17.4.4 Standard Release, as applicable."},"statusLabel":"Affected when a published public survey hash is known; CVE.org CNA record (Securifera)","addedDate":"2026-11-01"}]},"pocs":[{"title":"Securifera write-up (for defenders)","url":"https://www.securifera.com/blog/2026/09/27/survey-says-remote-code-execution-cve-2026-90817/","source":"b0yd, Securifera","validationStatus":"unverified","validationDate":null,"listedDate":"2026-09-27","notes":"Discoverer write-up (27 Sep 2026). Researcher reports unauthenticated RCE given a public survey hash. Independent validation: not verified. Listed for defenders. This site does not republish exploit code or usage steps.","addedDate":"2026-11-01"},{"title":"securifera/CVE-2026-90817 (discoverer repository)","url":"https://github.com/securifera/CVE-2026-90817","source":"Securifera","validationStatus":"unverified","validationDate":null,"listedDate":"2026-10-01","notes":"Discoverer repository created 1 Oct 2026 15:34 UTC (description: REDCap DataImport RCE). Independent validation: not verified. Index link only. This site does not copy exploit code or usage steps.","addedDate":"2026-11-01"},{"title":"murrez/CVE-2026-90817","url":"https://github.com/murrez/CVE-2026-90817","source":"murrez","validationStatus":"unverified","validationDate":null,"listedDate":"2026-09-21","notes":"Public repository created 21 Sep 2026 04:05 UTC. Description: unauthenticated REDCap RCE mass check PoC; requires a public survey hash. Independent validation: not verified. Index link only.","addedDate":"2026-11-01"},{"title":"ExDev994/CVE-2026-90817","url":"https://github.com/ExDev994/CVE-2026-90817","source":"ExDev994","validationStatus":"unverified","validationDate":null,"listedDate":"2026-09-21","notes":"Public repository created 21 Sep 2026 06:07 UTC. Independent validation: not verified. Index link only.","addedDate":"2026-11-01"},{"title":"yulisec/CVE-2026-90817","url":"https://github.com/yulisec/CVE-2026-90817","source":"yulisec","validationStatus":"unverified","validationDate":null,"listedDate":"2026-09-24","notes":"Public repository created 24 Sep 2026 07:39 UTC. Independent validation: not verified. Index link only.","addedDate":"2026-11-01"},{"title":"Farih123/CVE-2026-90817","url":"https://github.com/Farih123/CVE-2026-90817","source":"Farih123","validationStatus":"unverified","validationDate":null,"listedDate":"2026-09-26","notes":"Public repository created 26 Sep 2026 01:27 UTC. Independent validation: not verified. Index link only.","addedDate":"2026-11-01"}],"pocEmptyState":"Public Securifera write-up and repository are indexed, plus four other GitHub repositories opened in this pass. Independent validation: not verified.","_feed":{"page":"https://vuln2shell.com/vulns/redcap-cve-2026-90817","json":"https://vuln2shell.com/vulns/redcap-cve-2026-90817.json","iocsCsv":"https://vuln2shell.com/vulns/redcap-cve-2026-90817/iocs.csv","stix":"https://vuln2shell.com/vulns/redcap-cve-2026-90817/stix.json","badges":{"patch":"Patched","itw":"Reported exploited","poc":"Public PoC (unverified RCE)"}}}