---
title: REDCap CVE-2026-90817 unauthenticated RCE exploited via public surveys | ctxsec
url: https://ctxsec.com/items/redcap
description: ""
status: "exploited (researcher), not on KEV"
published: 2026-10-13
---

> 

[← Cybersecurity News](/news) · [markdown](/items/redcap.md)

exploited (researcher), not on KEV

2026-10-13

### REDCap CVE-2026-90817 unauthenticated RCE exploited via public surveys

Unit 42 reports attacks dropping a webshell then a fileless XMRig miner. Fixed in 16.0.49, 17.3.10 and 17.4.4. Not in CISA KEV as of Oct 13; NVD has no entry yet.

Sources: [Unit 42 (via @Unit42_Intel)](https://x.com/Unit42_Intel/status/2109811397617992120)