CVE-2026-90817: Critical RCE in REDCap via survey hash code injection

REDCap, the Vanderbilt-developed clinical research data platform, has an unauthenticated code injection flaw tracked as CVE-2026-90817 (CWE-94), present in versions 13.3.0 and later. Per the initial OffSeq radar listing, improper code generation around the survey hash lets an attacker with no credentials reach full server compromise. On September 27 Securifera published a detailed walkthrough titled Survey Says: Remote Code Execution, describing the chain from unauthenticated access to RCE using PHP filter chains, a technique that needs no file upload and works against stock PHP deployments.

This matters because REDCap holds sensitive clinical and research data at universities and hospitals, and the survey hash path is reachable without authentication. A public exploit writeup from a reputable research firm converts a paper CVE into a recipe any actor can follow, and the affected version range covers current deployments. Triage flags exploitation as suspected: the Securifera post demonstrates a working chain but reports no observed in-the-wild use.

Watch for a vendor advisory and fixed build from the REDCap team, confirmation of exactly which deployments are affected below and above 13.3.0, and any telemetry of survey-hash probing in internet-facing logs. Institutions running REDCap should treat exposure of its survey endpoints as urgent until a patched release is confirmed and applied.