DataDirect ARC GenAI Agents

Progress Software has released a patch for a critical command injection vulnerability, tracked as CVE-2026-91140, affecting its DataDirect ARC GenAI Agents. The flaw allowed attackers to execute arbitrary code through malicious OpenAPI input. Security teams are being urged to apply the update promptly, as the vulnerability could expose AI agent deployments to remote code execution attacks.