Critical Vulnerability in Progress DataDirect ARCGenAI Agents Disclosed
ID: b23f3d49-a636-549c-b270-a1c3ddabf345
STIX ID: report--b23f3d49-a636-549c-b270-a1c3ddabf345
Feed Name: ThreatCluster
Threat Score
Progress Software disclosed a critical vulnerability (CVE-2026-91140, CVSS 9.6) in its DataDirect Autonomous REST Connector GenAI Agents that allows arbitrary OS command execution via crafted OpenAPI/Swagger documents containing shell metacharacters in filenames; a patch (agent definitions v2.1) is available and no exploitation in the wild has been confirmed.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.