Progress Softwareが提供するデータ連携ツール「Progress DataDirect」の一部定義ファイルに ：Security NEXT

Progress Softwareが提供するデータ連携ツール「Progress DataDirect」の一部定義ファイルに ：Security NEXT

Progress Softwareのデータ連携ツール「Progress DataDirect」のAIエージェント定義ファイルに脆弱性が発見された。詳細な影響範囲と対応方法については、Progress Softwareからの公式発表を確認する必要がある。

Progress Softwareは、同社の「DataDirect Autonomous REST Connector（ARC）AI Model Generator」エージェントのアーリーアクセス版に、深刻なコマンドインジェクションの脆弱性（CVE-2026-91140）が存在すると公表しました。 細工したOpenA

Progressは、同社の「DataDirect Autonomous REST Connector AI Model Generator」エージェントの早期アクセス版（Early Access Release）に、深刻なコマンドインジェクションの脆弱性が存在することを公表しました。CVEデータベースへのアクセス こ

Progress disclosed critical command injection flaw CVE-2026-91140 in DataDirect Autonomous REST Connector AI Model Generator agents, allowing malicious OpenAPI or Swagger documents to execute arbitrary OS commands . The security bulletin, published on October 6, 2026, covers Early Access agent definitions available through the public progress/datadirect-arc-ai-model-gen GitHub repository. Progress has released updated definitions and urges customers to retrieve them before running the agents again. The vulnerability originates from a filename value derived from an OpenAPI or Swagger document . Affected agent definitions use this value in a shell operation without sufficient validation and quoting, allowing specially crafted input to change how the shell interprets the operation. The vulnerability description identifies shell-based temporary-file cleanup instructions as the affected execution path. An attacker can supply a document containing shell metacharacters within the filename value. When a developer invokes the vulnerable generator, those characters can cause the shell to execute attacker-controlled commands instead of treating the value only as a filename. This makes document processing the attack entry point. The malicious content does not need to arrive as a standalone executable. Instead, an apparently ordinary API specification becomes dangerous when the affected agent passes document-derived data into a shell command. Progress DataDirect GenAI Flaw Successful exploitation can affect a developer workspace or a continuous integration environment where the agent runs. Progress warns that customers may observe unexpected files, commands, or other changes in these environments. The vulnerability does not generate a specific product error message, meaning an obvious application warning cannot be relied upon to identify exploitation. Progress identifies three affected files: ARCGenAI-Generator.agent.md version 2.0, ARCGenAI-Generator.prompt.md version 1.0, and ARCGenAI-EntityGen.agent.md version 1.0. These are agent and prompt definitions distributed through the project repository. The corrected release updates all three definitions to version 2.1. Customers should check each file rather than assuming that replacing only the main generator definition addresses every affected component listed in the advisory. Progress says the fix requires pulling the latest agent definitions from the repository. No installer, patch installation, or migration is required. The company strongly recommends completing this update before using the agents again. Customers who previously processed untrusted or third-party OpenAPI or Swagger documents with affected definitions should review the associated workspace or CI environment for unexpected files and other signs of command execution. This retrospective review is separate from updating the definitions because the advisory also addresses environments where potentially malicious documents were already processed. Customers with questions or concerns can open a Progress Technical Support case. Stops threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC The post Critical Progress DataDirect GenAI Flaw Lets Malicious OpenAPI Files Execute OS Commands appeared first on Cyber Security News .

Een ernstige kwetsbaarheid, bekend als CVE-2026-91140, is aangetroffen in agents van DataDirect Autonomous REST Connector AI Model Generator. Deze kwetsbaarheid maakt onbevoegde uitvoering van willekeurige besturingssysteemcommando's mogelijk. De kwetsbaarheid ontstaat doordat een bestandsnaamwaarde, afgeleid van OpenAPI- of Swagger-documenten, zonder adequate validatie en aanhalingstekens wordt gebruikt in shell-operaties. Een aanvaller kan hier misbruik van maken door een document aan te leveren met shell-metatekens in de bestandsnaam. Dit stelt de aanvaller in staat om commando's uit te voeren naar eigen goeddunken, waarbij speciaal ontworpen invoer de shell manipuleert. De verwerking va...

TL;DR Progress has fixed CVE-2026-91140, a critical Progress DataDirect vulnerability in its Autonomous REST Connector AI Model Generator agents. A crafted OpenAPI or Swagger file could run commands wherever the agents process it. Updated agent definitions, version 2.1, close the hole. Why It Matters The flaw sits in AI agent definitions, not a traditional installer. Developers pull these files from the public progress/datadirect-arc-ai-model-gen repository on GitHub.

Artificial intelligence is changing what storage and data management platforms look like. In collaboration with Super Micro Computer Inc. and Solidigm, DataDirect Networks Inc. has introduced DDN Enterprise AI HyperPOD, built on Nvidia Corp.’s AI Data Platform. The goal is to simplify the storage, scaling and deployment of AI inference for enterprise workloads. “Customers are preferring best of breed, but that can often result in complexity,” said Andrew Murphy (pictured, right), senior director of product management at DDN. “The question is how can we help to offload that complexity from our customers so they can focus on what’s most important, which is taking their data that they’ve been generating over the years … [and] add context so that it can be ready for their AI factories.” Murphy, alongside Michael Ang (left), director of storage solutions at Supermicro, and Pompey Nagra (center), products and ecosystems lead at Solidigm, spoke with theCUBE’s Rob Strechay for the Supermicro Open Storage Summit interview series, during an exclusive broadcast on theCUBE, SiliconANGLE Media’s livestreaming studio. They discussed the collaboration and new trends in enterprise AI. (* Disclosure below.) One unified storage solution While customers traditionally buy individual storage, networking and compute platforms and build their...

Technology firm SCX partnered with DataDirect Networks on 25 August 2026 to deploy infrastructure supporting Australia's largest domestic artificial intelligence inferencing network.

Nvidia founder and CEO Jensen Huang said the market got it wrong when it comes to DeepSeek's technological advancements and its potential to negatively impact the chipmaker's business. Instead, Huang called DeepSeek's R1 open source reasoning model "incredibly exciting" while speaking with Alex Bouzari, CEO of DataDirect Networks, in a pre-recorded interview that was released on Thursday. Huang said that the release of R1 is inherently good for the AI market and will accelerate the adoption of AI as opposed to this release meaning that the market no longer had a use for compute resources — like the ones Nvidia produces.

Overview This is an incredible opportunity to be part of a company that has been at the forefront of AI and high-performance data storage innovation for over

Revolutionize your AI & HPC ops with DDN® data storage & management solutions. Achieve peak performance, seamless cloud integration & scalable efficiency.

Progress' DataDirect Hybrid Data Pipeline (HDP) connectivity solution allows cloud and on-premises data to be securely connected to BI tools.

Progress offers a DataDirect Connector that allows organizations to connect applications to Microsoft Fabric's Synapse Endpoint.

Improper Control of Generation of Code ('Code Injection') vulnerability in Progress DataDirect Connect for JDBC drivers, Progress DataDirect Open Access JDBC driver and Hybrid Data Pipeline allows Remote Code Inclusion. The SpyAttribute connection option implemented by the DataDirect Connect for JDBC drivers, DataDirect Hybrid Data Pipeline JDBC driver and the …

Improper Control of Generation of Code ('Code Injection') vulnerability in Progress DataDirect Connect for JDBC drivers, Progress DataDirect Open Access JDBC driver and Hybrid Data Pipeline allows Remote Code Inclusion. The SpyAttribute connection option implemented by the DataDirect Connect for JDBC drivers, DataDirect Hybrid Data Pipeline JDBC driver and the …