Insight Agent EUVD-2026-23376

Attacker must have existing local access to the target Windows system as a standard (non-administrative) user. The Rapid7 Insight Agent service must be installed and running at version greater than 4.1.0.2. Exploitation requires the specific OpenSSL configuration directory to not exist by default but be located in a path where standard users have filesystem write permissions. The attacker must be able to create the directory structure and write the openssl.cnf file before the agent service performs its next startup initialization (triggered by system reboot, manual service restart, or agent update). Exploitation is limited to Windows platforms only; Linux and macOS deployments are not vulnerable. The PR:N (no privileges required) metric indicates the attacker needs only standard user access, not administrative rights, making this exploitable by any authenticated local user account.

Real-world risk is HIGH for organizations running affected Insight Agent versions on Windows endpoints where multiple users have local access or where initial access has already been obtained by attackers. The CVSS 4.0 score of 8.5 accurately reflects the severity: local attack vector (AV:L) with low complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and high impact to confidentiality and integrity (VC:H/VI:H). The exploit maturity indicator E:P confirms proof-of-concept code exists, significantly lowering the barrier to exploitation. This vulnerability is particularly dangerous in post-exploitation scenarios where attackers have gained initial foothold as standard users and seek SYSTEM-level persistence. However, the local attack vector requirement means this cannot be exploited remotely without prior access, limiting its use as an initial attack vector. The vulnerability is CONFIRMED by vendor advisory (Rapid7 release notes), and the technical mechanism is well-documented in the description. Missing data: EPSS probability score and CISA KEV status would provide additional context for active exploitation prevalence, but absence from KEV suggests this is not yet widely exploited in the wild despite POC availability. Organizations should prioritize patching on multi-user Windows systems and endpoints at higher risk of initial compromise.

An attacker with standard user access to a Windows workstation or server running vulnerable Insight Agent versions identifies the non-existent OpenSSL configuration directory path through process monitoring or documentation. They create the missing directory structure and plant a malicious openssl.cnf file containing directives to load a custom cryptographic engine DLL or execute commands via OpenSSL's configuration hooks. When the Insight Agent service next starts (either at system boot, service restart, or scheduled maintenance), it loads the attacker-controlled configuration file with SYSTEM privileges and executes the embedded malicious code. The attacker now has full SYSTEM-level access to create administrative accounts, disable security software, exfiltrate sensitive data, or establish persistent backdoors. Proof-of-concept exploit code is publicly available.