EUVD-2026-48487
GHSA-pwvq-pmm8-79h9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local low-privileged account on managed host
-
DeliveryPlant malicious executable in scanned path
-
ExploitAuthenticated assessment discovers and runs binary
-
ExecutionCode executes as root/SYSTEM or scan credential
-
ImpactFull local host compromise
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V8 - Authorization Unnecessary privilege execution
|
| Exploitation Conditions | Exploitation requires that the host is actively assessed by Rapid7 InsightVM/Nexpose (authenticated scan) or the Insight Agent, and that the attacker is an existing local low-privileged user (PR:L) able to write a malicious executable into a filesystem location the assessment discovers and executes. The flaw is that discovered executables are run without file-ownership validation, so the concrete prerequisite is attacker-controlled write access to a scanned/executed path plus an assessment actually running. Limiting factors: this is local-only (AV:L), needs no user interaction (UI:N) but does require a low-privileged account and that an authenticated assessment occurs; privilege gained depends on the component - scan credential for Scan Engine, root/SYSTEM for the Insight Agent. Hosts not running these products, or not undergoing authenticated assessment, are not exposed. |
| Impact | The CVSS 3.1 base score is 7.8 (High) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning local access with low privileges and no user interaction, full CIA impact within an unchanged scope. This is a genuine escalation primitive rather than an inflated score: the attacker already needs a foothold as a local low-privileged user, but the payoff is code execution as root/SYSTEM (Insight Agent) or as the scan credential (Scan Engine), which are among the most privileged contexts on a host. No EPSS score, KEV listing, POC, or SSVC decision data was provided; absent those signals real-world exploitation appears opportunistic and dependent on the target actually running InsightVM/Nexpose/Insight Agent assessments. The main limiting factor is timing and placement - the malicious binary must sit where an authenticated assessment will discover and execute it - so exploitation is not fully automatable at will. Net priority: patch on standard cycle, prioritized on hosts running the Insight Agent given the root/SYSTEM impact. |
| Exploit ScenarioDerived | A low-privileged user on a Windows or Linux host managed by the Insight Agent places a malicious executable in a directory the agent's authenticated assessment enumerates and runs. When the scheduled assessment executes the planted binary without checking its ownership, the attacker's code runs as root or SYSTEM, giving full local control. No public POC is identified, and the local, low-complexity vector means no user interaction is required once the binary is staged. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 24, 2026
Local privilege escalation in Rapid7 InsightVM, Nexpose, and the Insight Agent allows a low-privileged user to gain elevated code execution by planting an executable in a location the scanner discovers and runs during an authenticated assessment. Because the products execute discovered executables without validating file ownership (CWE-250), the planted code runs as the scan credential on Scan Engine or as root/SYSTEM under the Insight Agent, yielding full local compromise. There is no public exploit identified at time of analysis and the CVE is not on CISA KEV, but the vendor-confirmed root/SYSTEM outcome makes this a meaningful escalation path.
RemediationAI
Apply the vendor-released content fixes: update Scan Engine content to 1.1.3935 (InsightVM/Nexpose) and the Insight Agent content component to 0.0.245.0, per the July 2026 Rapid7 release notes (https://docs.rapid7.com/insight/release-notes-2026-july/#vulnerability-management-insightvm and https://docs.rapid7.com/insight/release-notes-2026-july/#rapid7-agent-insight-agent); because these are content updates rather than binary upgrades, ensure automatic content distribution is enabled so engines and agents pull the corrected logic. Until content is updated, reduce exposure by tightening filesystem permissions so low-privileged users cannot write to directories that authenticated assessments traverse and execute from, and restrict interactive/local logon on scanned hosts - the trade-off is that overly aggressive path lockdown can cause software-inventory checks to miss legitimate binaries. Where feasible, limit authenticated scans against untrusted multi-user hosts, or scope scan credentials to the minimum privilege needed, accepting that reduced privileges may lower assessment coverage.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected technology is Rapid7's vulnerability-management stack: InsightVM and its Nexpose scan engine, plus the Insight Agent that performs local assessment on managed hosts (CPEs cpe:2.3:a:rapid7:insightvm, :nexpose, and :insight_agent). During an authenticated assessment these components enumerate and execute discovered executables on the target - a standard technique for gathering configuration and software inventory. The root cause is CWE-250, Execution with Unnecessary Privileges: the scanner/agent invokes those discovered binaries under a highly privileged security context (the scan credential for Scan Engine, or root/SYSTEM for the Insight Agent) without first verifying that the executable is owned by a trusted account. A low-privileged local user who can write to a path the assessment traverses can therefore substitute or plant a malicious binary that inherits the scanner's privileges when run.
Know when Insightvm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local vector with an existing low-privileged account and no user interaction; planting a binary run as root/SYSTEM yields full confidentiality, integrity, and availability impact.
Primary rating from Vendor (rapid7).
CVSS VectorVendor: rapid7
Lifecycle Timeline
2DescriptionCVE.org
Rapid7 InsightVM, Nexpose, and the Insight Agent execute discovered executables during authenticated assessment without validating file ownership, allowing a local low-privileged user to run code as the scan credential (Scan Engine) or as root/SYSTEM (Insight Agent). Fixed in Scan Engine content 1.1.3935 and Insight Agent content component 0.0.245.0.
Executive ViewAI
Rapid7's vulnerability scanning products (InsightVM, Nexpose, Insight Agent) contain a local privilege escalation vulnerability (CVSS 7.8) that enables attackers with low-level system access to achieve root or SYSTEM-level compromise. Since these tools underpin security assessments and typically have access to critical infrastructure data, their compromise directly undermines security program integrity and could expose sensitive assessment information. No public exploit identified at time of analysis, but the confirmed escalation path warrants immediate mitigation.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict local system access to scanning infrastructure via host-based access control lists and privilege minimization; (2) Implement file integrity monitoring on scan execution directories to detect malicious file placement; (3) Segment scanning infrastructure on isolated network segments with restricted inbound access; (4) Audit and remove unnecessary low-privileged user accounts on scanning systems; (5) Enable comprehensive system logging and monitoring for suspicious privilege escalation attempts or unexpected process execution.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Rapid7 Nexpose and InsightVM versions prior to 6.6.172 failed to reliably validate the authenticity of update contents.
Users with Site-level permissions can access files containing the username-encrypted passwords of Security Console Globa
Rapid7 InsightVM versions 6.6.178 and lower suffers from an open redirect vulnerability, whereby an attacker has the abi
Rapid7 InsightVM Console versions below 6.6.260 suffer from a protection mechanism failure whereby an attacker with netw
Rapid7's InsightVM maintenance mode login page suffers from a sensitive information exposure vulnerability whereby, sens
Exploit-DB