CVE-2026-91140

CRITICAL 9.6

OS command injection in Progress Software Autonomous REST Connector GenAI Agents

CVSS Score

9.6

EPSS Score

0.0%

EPSS Percentile

0th

An OS command injection vulnerability in the shell-based temporary-file cleanup instructions in Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator version 2.0 allows an attacker who supplies a crafted Swagger/OpenAPI document to execute arbitrary commands on a developer's machine when a user invokes the generator.

CWE	CWE-78
Vendor	progress software
Product	autonomous rest connector genai agents
Published	Oct 6, 2026
Last Updated	Oct 6, 2026

Stay Ahead of the Next One

Get instant alerts for progress software autonomous rest connector genai agents

Be the first to know when new critical vulnerabilities affecting progress software autonomous rest connector genai agents are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

Progress Software / Autonomous REST Connector GenAI Agents

2.0 < 2.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/progress/datadirect-arc-ai-model-gen/commit/7ede6d96eb033d647ffdcabf8d8069c098293575 community.progress.com: https://community.progress.com/s/article/Progress-DataDirect-Critical-Security-Alert-Bulletin-September-2026-CVE-2026-91140

Credits

Abhishek Nandkumar Bhaskar (Abhi-Hackz)