Insight Agent CVE-2026-4482

This vulnerability presents moderate real-world risk despite the high CVSS score (6.8) because exploitation requires local system access (AV:L/AC:L/PR:L), which limits the attacker surface compared to network-exploitable flaws. The CVSS vector confirms authentication requirement (PR:L - standard user privilege needed), narrowing the threat model to compromised user accounts, insider threats, or multi-stage attacks. However, Insight Agent's role as an endpoint detection and response agent makes key disclosure particularly dangerous: an attacker obtaining client.key can impersonate the agent to the Rapid7 backend, potentially exfiltrating telemetry, disabling detection capabilities, or achieving persistent access. The information disclosure impact (SI:L via agent identity exposure) combined with integrity concern (SI:L on system context) elevates practical risk. No EPSS, KEV, or POC data provided suggests this is not yet widely exploited, reducing urgency but not eliminating the need for patching in multi-user environments (shared systems, terminal servers, developer workstations).

A standard user on a Windows system running Rapid7 Insight Agent reads the client.key file from …/bootstrap/common/ssl using standard file system access (e.g., File Explorer or PowerShell) due to overly permissive ACLs. The attacker obtains the private key and uses it to forge API requests to the Rapid7 backend, spoofing the agent identity to query collected telemetry, disable incident response actions, or plant false forensic artifacts. Local authentication (user login) is required, making this a targeted insider threat or secondary payload in a multi-stage compromise.