Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2026-14172

Rapid7 InsightVM, Nexpose, and Insight Agent Local Privilege Escalation via Unvalidated Executable Invocation

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
rapid7

Description

Rapid7 InsightVM, Nexpose, and the Insight Agent execute discovered executables during authenticated assessment without validating file ownership, allowing a local low-privileged user to run code as the scan credential (Scan Engine) or as root/SYSTEM (Insight Agent). Fixed in Scan Engine content 1.1.3935 and Insight Agent content component 0.0.245.0.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Rapid7 InsightVM

Default version status: unaffected

  • 0 to < 1.1.3935affected

Rapid7 Nexpose

Default version status: unaffected

  • 0 to < 1.1.3935affected

Rapid7 Insight Agent

Default version status: unaffected

  • 0 to < 0.0.245.0affected

References