{"id":"CVE-2026-1814","state":"PUBLISHED","title":"Rapid7 Nexpose Insecure Java Keystore Password Generation","description":"Rapid7 Nexpose versions 6.4.50 and later are vulnerable to an insufficient entropy issue in the CredentialsKeyStorePassword.generateRandomPassword() method. When updating legacy keystore passwords, the application generates a new password with insufficient length (7-12 characters) and a static prefix 'p', resulting in a weak keyspace. An attacker with access to the nsc.ks file can brute-force this password using consumer-grade hardware to decrypt stored credentials.","publishedAt":"2026-02-03T14:54:12.073Z","updatedAt":"2026-02-26T15:04:28.129Z","severity":{"score":6.8,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","source":"rapid7"},"assigner":"rapid7","products":["Rapid7 InsightVM/Nexpose"],"affected":[{"vendor":"Rapid7","product":"InsightVM/Nexpose","defaultStatus":"unaffected","versions":[{"version":"6.4.50","status":"affected","lessThan":"8.36.0","versionType":"semver"}],"modules":["CredentialsKeyStorePassword class (NSCStartupService)"],"platforms":["Linux","Windows"]}],"references":["https://www.atredis.com/disclosure"],"weaknesses":["CWE-331"],"ingestedAt":"2026-10-29T20:11:10.572Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/1xxx/CVE-2026-1814.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-1814","state":"PUBLISHED","datePublished":"2026-02-03T14:54:12.073Z","dateUpdated":"2026-02-26T15:04:28.129Z","assignerShortName":"rapid7","assignerOrgId":"9974b330-7714-4307-a722-5648477acda7","dateReserved":"2026-02-03T14:05:09.471Z"},"containers":{"cna":{"title":"Rapid7 Nexpose Insecure Java Keystore Password Generation","descriptions":[{"lang":"en","value":"Rapid7 Nexpose versions 6.4.50 and later are vulnerable to an insufficient entropy issue in the CredentialsKeyStorePassword.generateRandomPassword() method. When updating legacy keystore passwords, the application generates a new password with insufficient length (7-12 characters) and a static prefix 'p', resulting in a weak keyspace. An attacker with access to the nsc.ks file can brute-force this password using consumer-grade hardware to decrypt stored credentials."}],"affected":[{"vendor":"Rapid7","product":"InsightVM/Nexpose","defaultStatus":"unaffected","versions":[{"version":"6.4.50","status":"affected","lessThan":"8.36.0","versionType":"semver"}],"modules":["CredentialsKeyStorePassword class (NSCStartupService)"],"platforms":["Linux","Windows"]}],"references":[{"url":"https://www.atredis.com/disclosure","tags":["exploit","third-party-advisory"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"LOCAL","baseScore":6.8,"baseSeverity":"MEDIUM","exploitMaturity":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-331","description":"CWE-331 Insufficient Entropy","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"rapid7","orgId":"9974b330-7714-4307-a722-5648477acda7","dateUpdated":"2026-02-09T19:30:52.884Z"},"credits":[{"lang":"en","type":"finder","value":"Justin Kennedy"},{"lang":"en","type":"sponsor","value":"Atredis Partners"},{"lang":"en","type":"finder","value":"Stephen Breen"},{"lang":"en","type":"finder","value":"Phil Brass"}],"impacts":[{"capecId":"CAPEC-112","descriptions":[{"lang":"en","value":"CAPEC-112 Brute Force"}]}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"InsightVM or Nexpose customers with automatic product updates enabled will receive and process this update when it is released. Customers who manually control their own update version can utilize the manual update process within the security console to update to version 8.36.0 when it is made available. We recommend those customers schedule this update as soon as reasonably possible.<br>"}],"value":"InsightVM or Nexpose customers with automatic product updates enabled will receive and process this update when it is released. Customers who manually control their own update version can utilize the manual update process within the security console to update to version 8.36.0 when it is made available. We recommend those customers schedule this update as soon as reasonably possible."}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.5.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-1814","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-02-04T04:55:53.093730Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-02-26T15:04:28.129Z"}}]}}}