What’s Vulnerable › Vulnerabilities

CVE-2026-91140: OS command injection in Progress Software Autonomous REST Connector GenAI Agents

• Severity: critical (CVSS 9.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-06 · updated 2026-10-07
• Weakness: CWE-78

Description

An OS command injection vulnerability in the shell-based temporary-file cleanup instructions in Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator version 2.0 allows an attacker who supplies a crafted Swagger/OpenAPI document to execute arbitrary commands on a developer's machine when a user invokes the generator.

Affected products

• Progress Software Autonomous REST Connector GenAI Agents: from 2.0 before 2.1 — fixed in 2.1

How to fix

Upgrade to a fixed version: Progress Software Autonomous REST Connector GenAI Agents 2.1. Check the vendor advisory for mitigations.

References

• https://community.progress.com/s/article/Progress-DataDirect-Critical-Security-Alert-Bulletin-September-2026-CVE-2026-91140
• https://github.com/progress/datadirect-arc-ai-model-gen/commit/7ede6d96eb033d647ffdcabf8d8069c098293575

Get alerted when CVE-2026-91140 or the next vulnerability affects your stack