Acunetix CVE-2026-6958

Exploitation requires a local user account on the Windows host running Acunetix 25.11.251107123 - the CVSS vector PR:L confirms a low-privileged (non-administrative) account is sufficient. The attacker must have filesystem permissions to create a directory at the specific hardcoded path expected by wvsc.exe for its OpenSSL files; on standard Windows installations this is typically achievable by non-admin users depending on the parent directory's ACL. The wvsc.exe process must run as SYSTEM (its normal operational mode) and must subsequently attempt to load OpenSSL files - this occurs during scanning activity or service initialization. The vulnerability is Windows-platform-specific and does not affect Acunetix on other operating systems. Limiting factors: no network access is required or involved; exploitation is purely local; the attack is constrained to the specific Acunetix version named, and only systems where wvsc.exe is installed and running as SYSTEM are at risk.

The CVSS 4.0 score of 8.5 with AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H accurately captures the exploitation profile: the attack requires only a low-privileged local account, no complex conditions, no user interaction, and no special attack prerequisites. The absence of EPSS data in the provided intelligence limits probabilistic exploitation forecasting, and the vulnerability is not listed in CISA KEV, so active in-the-wild exploitation is not confirmed. However, the publicly available PoC (Full Disclosure + PDF writeup) substantially narrows the skill gap required; even a mid-sized enterprise security team in inowroclaw running Acunetix on shared analyst workstations should treat this as urgent, since any local user - including compromised service accounts - can reliably reach SYSTEM in a single reliable step. The primary real-world risk amplifier is Acunetix's typical deployment on dedicated security workstations that often already have multiple privileged users or remote-access tooling, giving lateral movement paths post-escalation. The CVSS scope metric does not capture subsequent-system impact, but a SYSTEM foothold on a scanner host typically grants access to stored scan credentials, API keys, and internal network reconnaissance data.

A low-privileged domain user with interactive access to a Windows server running Acunetix identifies - via the public PoC - the missing OpenSSL directory path that wvsc.exe expects. The attacker creates the directory, drops a malicious DLL named to match the expected OpenSSL filename, and waits for wvsc.exe to restart (e.g., after a scheduled scan or service restart). When wvsc.exe resumes its SYSTEM-context execution, it resolves the OpenSSL path, loads the attacker's DLL, and grants the attacker a SYSTEM-level reverse shell. A public PoC is confirmed available, making this a reliable, low-skill attack.