Description (CNA)
Rapid7 InsightVM, Nexpose, and the Insight Agent execute discovered executables during authenticated assessment without validating file ownership, allowing a local low-privileged user to run code as the scan credential (Scan Engine) or as root/SYSTEM (Insight Agent). Fixed in Scan Engine content 1.1.3935 and Insight Agent content component 0.0.245.0.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Rapid7 / InsightVM | affected 0 before 1.1.3935 |
| Rapid7 / Nexpose | affected 0 before 1.1.3935 |
| Rapid7 / Insight Agent | affected 0 before 0.0.245.0 |
CWE
CWE-250
References
- https://docs.rapid7.com/insight/release-notes-2026-july/#vulnerability-management-insightvm
- https://docs.rapid7.com/insight/release-notes-2026-july/#rapid7-agent-insight-agent
ADP enrichment
No English description supplied.
No references supplied.