Patchfirst
Patchfirst
CVE-2026-91140 Critical · 9.6 EPSS 2.0%

An OS command injection vulnerability in the shell-based temporary-file cleanup instructions in Progress Software…

Progress Software · Autonomous REST Connector GenAI Agents

Summary

An OS command injection flaw exists in the shell-based temporary-file cleanup instructions of Progress Software's Autonomous REST Connector GenAI Agents, specifically the ARCGenAI-Generator component in version 2.0. An attacker who can supply a crafted Swagger/OpenAPI document can run arbitrary commands on a developer's machine, but only if a user is induced to invoke the generator on that document.

Official description · NVD

An OS command injection vulnerability in the shell-based temporary-file cleanup instructions in Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator version 2.0 allows an attacker who supplies a crafted Swagger/OpenAPI document to execute arbitrary commands on a developer's machine when a user invokes the generator.

Breakdown
25.1 / 100
Exploited
Not confirmed
Reports
0
Tactics
0/15

Disclosed on 6 Oct 2026. No public exploit code or confirmed exploitation is recorded.

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

What security researchers reported

Not named in any threat report yet

Also mentioned in 8 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

2 links, grouped by NVD tag

Other 2

community.progress.com/s/article/Progress-DataDirect-Critical-Security-Alert-Bulletin-September-2026-CVE-2026-91140github.com/progress/datadirect-arc-ai-model-gen/commit/7ede6d96eb033d647ffdcabf8d8069c098293575
↑ ↓ chooseEnter openEsc close