CVE catalog
CVE-2026-7490
CTMS and CPAS developed by Sunnet has an Arbitrary File Upload vulnerability, allowing privileged remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution
- Severity
- High · CVSS 8.6
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.46% · Oct 25, 2026
CTMS and CPAS developed by Sunnet has an Arbitrary File Upload vulnerability, allowing privileged remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Cpe | ehrd_cpas | Not reported | Not reported | unknown |
| Cpe | ehrd_ctms | Not reported | Not reported | unknown |
| Cpe | ehrd_cpas | Not reported | Not reported | unknown |
| Cpe | ehrd_ctms | Not reported | Not reported | unknown |
Fixed-version evidence
OpenFactory catalog packages
No matching packages in this catalog.
Observed: