Critical severity · published Feb 19, 2026
CVE-2026-2731
Unauthenticated RCE in Dynamicweb 9 and Dynamicweb 8
10.0
CVSS
0.6%
EPSS
No
On KEV
Description
Path traversal and content injection in JobRunnerBackground.aspx in DynamicWeb 8 (all) and 9 (<9.19.7 and <9.20.3) allows unauthenticated attackers to execute code via simple web requests
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
D9
DynamicWeb 9 · DynamicWeb
8; 9 before 9.19.7; 9.20.0 before 9.20.3 · source: vendor