Metasploit Pro EUVD-2026-30498

Attacker must have interactive local access to the Windows system as a standard (non-administrative) user account. The Rapid7 Metasploit Pro software must be installed with the embedded PostgreSQL component (metasploitPostgreSQL service) present and configured to start. The OpenSSL library search path must include a directory that does not exist but resides within a filesystem location where the BUILTIN\Users group or Authenticated Users has write and create subdirectory permissions (typical for certain %PROGRAMDATA% subdirectories in default Windows configurations). The attacker must have the ability to create directories and files in this location, and the metasploitPostgreSQL service must restart or start after the malicious openssl.cnf is planted (either through service control permissions, system reboot, or scheduled maintenance). Exploitation is LIMITED by the requirement for local authenticated access-this is not remotely exploitable over the network. Remote attackers would first need to compromise a user account with local logon rights to the Metasploit Pro host.

Real-world risk is significant for organizations running Metasploit Pro on Windows in multi-user environments. CVSS 4.0 vector shows AV:L (local access required, limiting remote exploitation), AC:L (low complexity-no race conditions or special timing), PR:N (no authentication to the application itself required beyond Windows login as standard user), and UI:N (no user interaction needed). The environmental score shows high impacts across confidentiality, integrity, and availability (VC:H/VI:H/VA:L) with scope change (SC:H/SI:H/SA:H), reflecting full SYSTEM compromise from unprivileged context. E:P indicates proof-of-concept exists, elevating immediate risk. However, exploitation prerequisites substantially limit attack surface: attacker must already have interactive local access to the Windows host (not remote network exploitation), and the metasploitPostgreSQL service must be installed and running. This is not a wormable or mass-exploitation scenario-it requires initial foothold, making it a post-compromise privilege escalation step rather than initial access vector. SSVC assessment: exploitation is proven (POC exists), automatable within local context once conditions met, technical impact is total (SYSTEM access). Priority depends on threat model-high priority if Metasploit Pro runs on shared administrative workstations or jump hosts where multiple personnel have standard user access; lower priority for single-admin dedicated systems or properly hardened environments where local access is already tightly controlled.

A red team operator or insider with standard Windows user credentials logs into a Windows server running Metasploit Pro. The attacker uses Process Monitor to identify that postgres.exe attempts to load openssl.cnf from C:\ProgramData\PostgreSQL\config\ (hypothetical path), which does not exist but is writable by Users group. The attacker creates this directory structure and plants a malicious openssl.cnf containing an engine directive that loads an attacker-controlled DLL from the same directory. The DLL contains a reverse shell payload. The attacker then triggers metasploitPostgreSQL service restart (via net stop/start if permissions allow, or waits for system reboot or scheduled service restart). Upon service startup, postgres.exe running as SYSTEM loads the malicious configuration, executes the attacker's DLL, and establishes a SYSTEM-level shell back to the attacker's listener, achieving full host compromise from an initially unprivileged position.