CVE-2026-7490highCWE-434

CVE-2026-7490: high-severity vulnerability in Sunnet CTMS

Sunnet｜CTMS and CPAS - Arbitrary File Upload

Published · Updated

Follow this CVE+ Monitor CTMS+ Monitor CPAS

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.6epss 0.5%
CTMS and CPAS developed by Sunnet has an Arbitrary File Upload vulnerability, allowing privileged remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
Sunnet · CPASSunnet · CTMS
Related CVEs — Sunnet CTMS

In the same product, most dangerous first.

CVE-2026-7489HIGHSunnet｜CTMS - SQL InjectionEPSS 0.3%