CVE-2026-2731: Unauthenticated RCE in Dynamicweb 9 and Dynamicweb 8

Severity: critical (CVSS 10.0 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-02-19 · updated 2026-06-17
Weakness: CWE-22

Description

Path traversal and content injection in JobRunnerBackground.aspx in DynamicWeb 8 (all) and 9 (<9.19.7 and <9.20.3) allows unauthenticated attackers to execute code via simple web requests

Affected products

DynamicWeb 9: from 9 before 9.19.7; from 9.20.0 before 9.20.3; 8 — fixed in 9.19.7, 9.20.3

How to fix

Upgrade to a fixed version: DynamicWeb 9 9.19.7, 9.20.3. Check the vendor advisory for mitigations.

References

https://doc.dynamicweb.dev/documentation/fundamentals/dw10release/security-reports.html#january-19th-2026---unauthenticated-rce-dynamicweb-9-and-dynamicweb-8

Get alerted when CVE-2026-2731 or the next vulnerability affects your stack