EUVD-2026-48487
GHSA-pwvq-pmm8-79h9
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local vector with an existing low-privileged account and no user interaction; planting a binary run as root/SYSTEM yields full confidentiality, integrity, and availability impact.
Primary rating from Vendor (rapid7).
CVSS VectorVendor: rapid7
Lifecycle Timeline
3DescriptionCVE.org
Rapid7 InsightVM, Nexpose, and the Insight Agent execute discovered executables during authenticated assessment without validating file ownership, allowing a local low-privileged user to run code as the scan credential (Scan Engine) or as root/SYSTEM (Insight Agent). Fixed in Scan Engine content 1.1.3935 and Insight Agent content component 0.0.245.0.
AnalysisAI
Local privilege escalation in Rapid7 InsightVM, Nexpose, and the Insight Agent allows a low-privileged user to gain elevated code execution by planting an executable in a location the scanner discovers and runs during an authenticated assessment. Because the products execute discovered executables without validating file ownership (CWE-250), the planted code runs as the scan credential on Scan Engine or as root/SYSTEM under the Insight Agent, yielding full local compromise. There is no public exploit identified at time of analysis and the CVE is not on CISA KEV, but the vendor-confirmed root/SYSTEM outcome makes this a meaningful escalation path.
Technical ContextAI
The affected technology is Rapid7's vulnerability-management stack: InsightVM and its Nexpose scan engine, plus the Insight Agent that performs local assessment on managed hosts (CPEs cpe:2.3:a:rapid7:insightvm, :nexpose, and :insight_agent). During an authenticated assessment these components enumerate and execute discovered executables on the target - a standard technique for gathering configuration and software inventory. The root cause is CWE-250, Execution with Unnecessary Privileges: the scanner/agent invokes those discovered binaries under a highly privileged security context (the scan credential for Scan Engine, or root/SYSTEM for the Insight Agent) without first verifying that the executable is owned by a trusted account. A low-privileged local user who can write to a path the assessment traverses can therefore substitute or plant a malicious binary that inherits the scanner's privileges when run.
RemediationAI
Apply the vendor-released content fixes: update Scan Engine content to 1.1.3935 (InsightVM/Nexpose) and the Insight Agent content component to 0.0.245.0, per the July 2026 Rapid7 release notes (https://docs.rapid7.com/insight/release-notes-2026-july/#vulnerability-management-insightvm and https://docs.rapid7.com/insight/release-notes-2026-july/#rapid7-agent-insight-agent); because these are content updates rather than binary upgrades, ensure automatic content distribution is enabled so engines and agents pull the corrected logic. Until content is updated, reduce exposure by tightening filesystem permissions so low-privileged users cannot write to directories that authenticated assessments traverse and execute from, and restrict interactive/local logon on scanned hosts - the trade-off is that overly aggressive path lockdown can cause software-inventory checks to miss legitimate binaries. Where feasible, limit authenticated scans against untrusted multi-user hosts, or scope scan credentials to the minimum privilege needed, accepting that reduced privileges may lower assessment coverage.
More in Insight Agent
View allRapid7 Insight Agent versions 3.1.2.38 and earlier suffer from a privilege escalation vulnerability, whereby an attacker
Rapid7 Insight Agent, version 2.6.3 and prior, suffers from a local privilege escalation due to an uncontrolled DLL sear
Local privilege escalation in Rapid7 Insight Agent (versions > 4.1.0.2) on Windows allows unprivileged users to execute
Rapid7 Insight Agent, versions 3.0.1 to 3.1.2.34, suffer from a local privilege escalation due to an uncontrolled DLL se
Rapid7 Insight Agent token handler versions 3.2.6 and below, suffer from a Directory Traversal vulnerability whereby uns
Remote code execution in Rapid7 Insight Agent for Linux versions prior to 4.1.0.2 allows authenticated attackers with hi
Improperly restricted file permissions on Rapid7 Insight Agent installer certificate files on Windows systems allow loca
Same weakness CWE-250 – Execution with Unnecessary Privileges
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today