How do I check whether I am affected by CVE-2023-29492?

Check the installed Novi Survey version on the server (admin/about page or the installed product version). Anything below 8.9.43676 is vulnerable.

What is the fix for CVE-2023-29492?

Upgrade the installation to Novi Survey 8.9.43676 or later. The vendor says there is no workaround for earlier versions.

Who is not affected by CVE-2023-29492?

Not affected if: managed-hosting.

Live › vulnerability › CVE-2023-29492

Go to dashboard

critical9.8Exploited in the wildVendor

3rdmill novi survey: Novi Survey before 8.9.43676 allows remote attackers to execute arbitrary code on the server in the context of the…

Novi Survey's installable (self-hosted) software has a remote code execution flaw (CVSS 9.8). Unauthenticated remote attackers can run code on the server as the service account. Survey and response data are not exposed directly. It is in CISA KEV (added 2023-04-13). The vendor-hosted service is not listed as affected.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

9.8

critical

scored by [email protected]

known so far6 of 6

First public: Apr 11, 2023 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: Listed in CISA KEV
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.

Why it is critical, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: Yes, on CISA KEV since Apr 13, 2023.
Needs login: Not known from the sources.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Remote code execution on the server as the service account.
CVSS said: 9.8. The facts above agree.

Known exploitation

CISA KEV

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2023-29492

Go to dashboard

critical9.8Exploited in the wildVendor

3rdmill novi survey: Novi Survey before 8.9.43676 allows remote attackers to execute arbitrary code on the server in the context of the…

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

9.8

critical

scored by [email protected]

known so far6 of 6

First public: Apr 11, 2023 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: Listed in CISA KEV
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.

Why it is critical, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: Yes, on CISA KEV since Apr 13, 2023.
Needs login: Not known from the sources.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Remote code execution on the server as the service account.
CVSS said: 9.8. The facts above agree.

Known exploitation

CISA KEV

Know the next one before it finds you.

Add to Slack

Product	Ecosystem	Affected	Fixed in
Novi Survey Novi Survey	vendor	–	–
Novi Survey	vendor	< 8.9.43676	8.9.43676
3rdmill novi survey	vendor	< 8.9.43676	8.9.43676

3rdmill novi survey: Novi Survey before 8.9.43676 allows remote attackers to execute arbitrary code on the server in the context of the…

Why it is critical, and not just CVSS

Known exploitation

Know the next one before it finds you.

3rdmill novi survey: Novi Survey before 8.9.43676 allows remote attackers to execute arbitrary code on the server in the context of the…

Why it is critical, and not just CVSS

Known exploitation

Know the next one before it finds you.

Who is affected

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources