CVE-2026-14172
HIGHRapid7 InsightVM, Nexpose, and Insight Agent Local Privilege Escalation via Unvalidated Executable Invocation
Title source: cnaDescription
Rapid7 InsightVM, Nexpose, and the Insight Agent execute discovered executables during authenticated assessment without validating file ownership, allowing a local low-privileged user to run code as the scan credential (Scan Engine) or as root/SYSTEM (Insight Agent). Fixed in Scan Engine content 1.1.3935 and Insight Agent content component 0.0.245.0.
References (2)
Core 2
Core References
Release Notes release-notes
Rapid7 InsightVM Release Notes
https://docs.rapid7.com/insight/release-notes-2026-july/#vulnerability-management-insightvm
Release Notes release-notes
Rapid7 Insight Agent Release Notes
https://docs.rapid7.com/insight/release-notes-2026-july/#rapid7-agent-insight-agent
Scores
CVSS v3
7.8
EPSS
0.0011
EPSS Percentile
1.3%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-250
Status
published
Products (3)
Rapid7/Insight Agent
< 0.0.245.0
Rapid7/InsightVM
< 1.1.3935
Rapid7/Nexpose
< 1.1.3935
Published
Jul 24, 2026
Tracked Since
Jul 24, 2026