Sunnet CTMS/CPAS Arbitrary File Upload Allows RCE
The National Vulnerability Database has disclosed CVE-2026-7490, a critical arbitrary file upload vulnerability impacting Sunnet’s CTMS and CPAS products. This flaw, rated with a CVSS score of 7.2 (HIGH), enables a privileged remote attacker to upload and execute web shell backdoors. This directly leads to arbitrary code execution on the server.
The attacker’s calculus here is straightforward: gain privileged access, drop a web shell, and own the box. Arbitrary code execution is the endgame for many attackers, offering full control over the compromised system. This isn’t just about data exfiltration; it’s about persistent access, lateral movement, and potentially using the compromised server as a pivot point for further attacks.
Defenders need to treat any unpatched Sunnet CTMS or CPAS instance as a high-risk asset. The fact that it requires privileged access somewhat mitigates the immediate widespread internet exposure, but it amplifies the threat from insider risks or compromised credentials. Once an attacker has those credentials, this vulnerability becomes trivial to exploit, bypassing many perimeter defenses.
What This Means For You
- If your organization utilizes Sunnet's CTMS or CPAS, you must identify all instances immediately. Prioritize patching or implementing mitigation strategies as soon as they become available. Assume that any privileged credentials for these systems are high-value targets for attackers; audit their usage and strengthen access controls.
Related ATT&CK Techniques
🛡️ Detection Rules
3 rules · 6 SIEM formats3 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
CVE-2026-7490 - Sunnet CTMS/CPAS Arbitrary File Upload Webshell
title: CVE-2026-7490 - Sunnet CTMS/CPAS Arbitrary File Upload Webshell
id: scw-2026-05-02-ai-1
status: experimental
level: critical
description: |
Detects the arbitrary file upload vulnerability in Sunnet CTMS/CPAS (CVE-2026-7490). This rule specifically looks for POST requests to known upload endpoints with parameters indicating file uploads of script types (jsp, php) that result in a successful upload (200 status code) and the presence of the script file in the URI. This is a primary indicator of a webshell being uploaded for Remote Code Execution.
author: SCW Feed Engine (AI-generated)
date: 2026-05-02
references:
- https://shimiscyberworld.com/posts/nvd-CVE-2026-7490/
tags:
- attack.initial_access
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-method:
- 'POST'
cs-uri|contains:
- '/ctms/upload'
- '/cpas/upload'
cs-uri-query|contains:
- 'filetype=jsp'
- 'filetype=php'
sc-status:
- 200
selection_base:
uri|contains:
- '.jsp'
- '.php'
condition: selection AND selection_base
falsepositives:
- Legitimate administrative activity
Source: Shimi's Cyber World · License & reuse
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-7490 | RCE | Sunnet CTMS - Arbitrary File Upload leading to web shell execution |
| CVE-2026-7490 | RCE | Sunnet CPAS - Arbitrary File Upload leading to web shell execution |
Written by SCW Vulnerability Desk
Source & Attribution
| Source Platform | NVD |
| Channel | National Vulnerability Database |
| Published | May 02, 2026 at 13:16 UTC |
This content was AI-rewritten and enriched by Shimi's Cyber World based on the original source. All intellectual property rights remain with the original author.
Believe this infringes your rights? Submit a takedown request.
Related coverage
CVE-2026-7627 — 8nite Metatrader-4-Mcp Path Traversal
CVE-2026-7627 — A security vulnerability has been detected in 8nite metatrader-4-mcp 1.0.0. This vulnerability affects the function CallToolRequestSchema of the file src/index.ts of the component...
CVE-2026-7612 — SQL Injection
CVE-2026-7612 — A vulnerability was determined in itsourcecode Courier Management System 1.0. Affected is an unknown function of the file /edit_user.php. Executing a manipulation of...
CVE-2026-7609 — TRENDnet TEW-821DAP Command Injection
CVE-2026-7609 — A flaw has been found in TRENDnet TEW-821DAP up to 1.12B01. The impacted element is the function tools_diagnostic of the file /tmp/diagnostic of...