CVE-2026-90817: REDCap Remote Code Execution — Cryptocurrency Mining Exploited (June 2026)

CVE-2026-90817 — REDCap Remote Code Execution

CVE-2026-90817 is a high-severity vulnerability in REDCap servers that allows unauthenticated remote code execution. This flaw is under active exploitation, with attackers deploying Monero cryptocurrency miners on compromised systems. There is no official CVSS score published yet, but exploitation is confirmed in the wild.

Attack Vector

Attackers leverage CVE-2026-90817 to gain remote code execution on vulnerable REDCap instances. Once access is obtained, malicious payloads are delivered to install and run Monero mining software. The campaign uses evasive techniques to maintain persistence, including process masquerading and periodic re-injection. Indicators of compromise include outbound connections to 202.61.130.221 and presence of the file hash 39a4351. Attackers also manipulate scheduled tasks and system binaries to evade detection.

Who Is at Risk

All organizations running unpatched REDCap servers are at risk, regardless of deployment size or region. Vanderbilt Health has been confirmed as affected. Both internet-facing and internal REDCap deployments are susceptible if not updated. The campaign is global in scope, targeting healthcare and research organizations in particular.

Patch & Mitigate

• Patch: Apply the latest REDCap security update addressing CVE-2026-90817 immediately. Check vendor advisories for exact version details.
• Workaround: If patching is not possible, restrict external access to REDCap servers and monitor for suspicious processes.
• Detect: Review logs for unusual outbound traffic to 202.61.130.221, unexpected process launches, and the presence of file hash 39a4351. Monitor for unauthorized scheduled tasks and binary modifications.

MITRE ATT&CK

• TA0002 — Execution: Attackers exploit the vulnerability to execute mining payloads remotely.
• TA0003 — Persistence: Evasive techniques such as scheduled tasks and process masquerading maintain attacker foothold.
• TA0005 — Defense Evasion: Modification of system binaries and obfuscation tactics are used to avoid detection.

Source: https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-10-07-XMRig-campaign-through-CVE-2026-90817.txt