Search
Find a vulnerability
Search criteria
4 vulnerabilities found for Acunetix by Invicti
GCVE-1988-2026-0172
Vulnerability from gna-1988 – Published: 2026-09-08 07:25 – Updated: 2026-09-09 13:02
VLAI
EPSS
VEX
Title
Acunetix 25.11.x - Local Privilege Escalation Vulnerability via OpenSSL Configuration (CVE-2026-6958)
Summary
Acunetix 25.11.x - Local Privilege Escalation Vulnerability via OpenSSL Configuration (CVE-2026-6958)
- Software Link:
https://www.acunetix.com
- Affected Versions:
Version 25.11.x (tested on Microsoft Windows 11 and 11 IoT Enterprise LTSC)
Other versions may be affected as well.
- Vulnerability Description:
A local privilege escalation vulnerability has been identified in Acunetix (Web Vulnerability Scanner, or abbreviated
AWVS) 25.11.x
The vulnerability is caused by the use of a hardcoded OpenSSL-related directory path that does not exist by default and
is writable by low-privileged users.
The affected binary, wvsc.exe, runs with SYSTEM privileges and attempts to load OpenSSL-related files from an hardcoded
location:
C:\builds\[PATH OMITTED]\[REDACTED]\openssl.cnf
Since this directory does not exist by default, a low-privileged local user can create the missing directory hierarchy
and place files in a location that is subsequently accessed by the SYSTEM-level process.
As a result, files placed in the attacker-controlled directory may be loaded or otherwise processed by wvsc.exe with
SYSTEM privileges, potentially allowing a local unprivileged attacker to escalate privileges to SYSTEM.
The issue is therefore an insecure OpenSSL directory/search path combined with an unsafe filesystem permission model.
- Proof of Concept:
The PoC in the original advisory demonstrates that a low-privileged local user can create the otherwise missing
directory and cause the SYSTEM-level wvsc.exe process to access attacker-controlled OpenSSL-related files from that
location.
- Impact:
A local attacker with low privileges can potentially execute code with SYSTEM-level privileges, depending on the
OpenSSL-related file being loaded and the execution path reached by wvsc.exe.
- Solution:
The vendor should remove references to development/build-time paths from production binaries and ensure that all
OpenSSL-related files are loaded only from trusted, administrator-controlled directories.
Additionally, filesystem permissions should prevent unprivileged users from creating or modifying directories used by
privileged processes.
- Disclosure Timeline:
[18/04/2026] - Vulnerability discovered
[23/04/2026] - CNA and vendor contacted
[23/04/2026] - Vulnerability details provided - deadline set at 120 days, in accordance with the CNA disclosure policy
[ meantime ] - Multiple follow-up attempts by the CNA to the vendor; Invicti Security repeatedly replied with same
standard message
[31/08/2026] - Public disclosure
- CVE Reference:
CVE-2026-6958 has been assigned to this vulnerability.
- Credits:
Vulnerability discovered by Andrea Intilangelo
- Original Advisory:
https://olografix.org/acme/_poc/CVE-2026-6958.pdf
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
6 references
Relationships
reference
GCVE-1988-2026-0172 (this record)
- related CVE-2026-6958
{
"containers": {
"cna": {
"affected": [
{
"product": "Acunetix",
"vendor": "Invicti",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Andrea Intilangelo"
}
],
"descriptions": [
{
"lang": "en",
"value": "Acunetix 25.11.x - Local Privilege Escalation Vulnerability via OpenSSL Configuration (CVE-2026-6958)\n\n- Software Link:\n\nhttps://www.acunetix.com\n\n- Affected Versions:\n\nVersion 25.11.x (tested on Microsoft Windows 11 and 11 IoT Enterprise LTSC)\nOther versions may be affected as well.\n\n- Vulnerability Description:\n\nA local privilege escalation vulnerability has been identified in Acunetix (Web Vulnerability Scanner, or abbreviated \nAWVS) 25.11.x\nThe vulnerability is caused by the use of a hardcoded OpenSSL-related directory path that does not exist by default and \nis writable by low-privileged users.\nThe affected binary, wvsc.exe, runs with SYSTEM privileges and attempts to load OpenSSL-related files from an hardcoded \nlocation:\n\nC:\\builds\\[PATH OMITTED]\\[REDACTED]\\openssl.cnf\n\nSince this directory does not exist by default, a low-privileged local user can create the missing directory hierarchy \nand place files in a location that is subsequently accessed by the SYSTEM-level process.\nAs a result, files placed in the attacker-controlled directory may be loaded or otherwise processed by wvsc.exe with \nSYSTEM privileges, potentially allowing a local unprivileged attacker to escalate privileges to SYSTEM.\n\nThe issue is therefore an insecure OpenSSL directory/search path combined with an unsafe filesystem permission model.\n\n- Proof of Concept:\n\nThe PoC in the original advisory demonstrates that a low-privileged local user can create the otherwise missing \ndirectory and cause the SYSTEM-level wvsc.exe process to access attacker-controlled OpenSSL-related files from that \nlocation.\n\n- Impact:\n\nA local attacker with low privileges can potentially execute code with SYSTEM-level privileges, depending on the \nOpenSSL-related file being loaded and the execution path reached by wvsc.exe.\n\n- Solution:\n\nThe vendor should remove references to development/build-time paths from production binaries and ensure that all \nOpenSSL-related files are loaded only from trusted, administrator-controlled directories.\n\nAdditionally, filesystem permissions should prevent unprivileged users from creating or modifying directories used by \nprivileged processes.\n\n- Disclosure Timeline:\n\n[18/04/2026] - Vulnerability discovered\n[23/04/2026] - CNA and vendor contacted\n[23/04/2026] - Vulnerability details provided - deadline set at 120 days, in accordance with the CNA disclosure policy\n[ meantime ] - Multiple follow-up attempts by the CNA to the vendor; Invicti Security repeatedly replied with same \nstandard message\n[31/08/2026] - Public disclosure\n\n- CVE Reference:\n\nCVE-2026-6958 has been assigned to this vulnerability.\n\n- Credits:\n\nVulnerability discovered by Andrea Intilangelo\n\n- Original Advisory:\n\nhttps://olografix.org/acme/_poc/CVE-2026-6958.pdf\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:02:40Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/0"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Sep/0"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://olografix.org/acme/_poc/CVE-2026-6958.pdf"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.acunetix.com"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Sep/0"
],
"discovery": "EXTERNAL"
},
"title": "Acunetix 25.11.x - Local Privilege Escalation Vulnerability via OpenSSL Configuration (CVE-2026-6958)",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2026-6958",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0172",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/0",
"automated": true,
"contentSha256": "e25146b1aeacd2cf6ba32a2de80dd1d200e8e23a85ddc6f4f22a401c5f753e15",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/0",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-31T10:21:01Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0172"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-08T07:25:42Z",
"dateUpdated": "2026-09-09T13:02:40Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0172"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0160
Vulnerability from gna-1988 – Published: 2026-09-07 13:35 – Updated: 2026-09-09 13:02
VLAI
EPSS
VEX
Title
Acunetix 25.11.x - Local Privilege Escalation Vulnerability via OpenSSL Configuration (CVE-2026-6958)
Summary
Acunetix 25.11.x - Local Privilege Escalation Vulnerability via OpenSSL Configuration (CVE-2026-6958)
- Software Link:
https://www.acunetix.com
- Affected Versions:
Version 25.11.x (tested on Microsoft Windows 11 and 11 IoT Enterprise LTSC)
Other versions may be affected as well.
- Vulnerability Description:
A local privilege escalation vulnerability has been identified in Acunetix (Web Vulnerability Scanner, or abbreviated
AWVS) 25.11.x
The vulnerability is caused by the use of a hardcoded OpenSSL-related directory path that does not exist by default and
is writable by low-privileged users.
The affected binary, wvsc.exe, runs with SYSTEM privileges and attempts to load OpenSSL-related files from an hardcoded
location:
C:\builds\[PATH OMITTED]\[REDACTED]\openssl.cnf
Since this directory does not exist by default, a low-privileged local user can create the missing directory hierarchy
and place files in a location that is subsequently accessed by the SYSTEM-level process.
As a result, files placed in the attacker-controlled directory may be loaded or otherwise processed by wvsc.exe with
SYSTEM privileges, potentially allowing a local unprivileged attacker to escalate privileges to SYSTEM.
The issue is therefore an insecure OpenSSL directory/search path combined with an unsafe filesystem permission model.
- Proof of Concept:
The PoC in the original advisory demonstrates that a low-privileged local user can create the otherwise missing
directory and cause the SYSTEM-level wvsc.exe process to access attacker-controlled OpenSSL-related files from that
location.
- Impact:
A local attacker with low privileges can potentially execute code with SYSTEM-level privileges, depending on the
OpenSSL-related file being loaded and the execution path reached by wvsc.exe.
- Solution:
The vendor should remove references to development/build-time paths from production binaries and ensure that all
OpenSSL-related files are loaded only from trusted, administrator-controlled directories.
Additionally, filesystem permissions should prevent unprivileged users from creating or modifying directories used by
privileged processes.
- Disclosure Timeline:
[18/04/2026] - Vulnerability discovered
[23/04/2026] - CNA and vendor contacted
[23/04/2026] - Vulnerability details provided - deadline set at 120 days, in accordance with the CNA disclosure policy
[ meantime ] - Multiple follow-up attempts by the CNA to the vendor; Invicti Security repeatedly replied with same
standard message
[31/08/2026] - Public disclosure
- CVE Reference:
CVE-2026-6958 has been assigned to this vulnerability.
- Credits:
Vulnerability discovered by Andrea Intilangelo
- Original Advisory:
https://olografix.org/acme/_poc/CVE-2026-6958.pdf
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
6 references
{
"containers": {
"cna": {
"affected": [
{
"product": "Acunetix",
"vendor": "Invicti",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Andrea Intilangelo"
}
],
"descriptions": [
{
"lang": "en",
"value": "Acunetix 25.11.x - Local Privilege Escalation Vulnerability via OpenSSL Configuration (CVE-2026-6958)\n\n- Software Link:\n\nhttps://www.acunetix.com\n\n- Affected Versions:\n\nVersion 25.11.x (tested on Microsoft Windows 11 and 11 IoT Enterprise LTSC)\nOther versions may be affected as well.\n\n- Vulnerability Description:\n\nA local privilege escalation vulnerability has been identified in Acunetix (Web Vulnerability Scanner, or abbreviated \nAWVS) 25.11.x\nThe vulnerability is caused by the use of a hardcoded OpenSSL-related directory path that does not exist by default and \nis writable by low-privileged users.\nThe affected binary, wvsc.exe, runs with SYSTEM privileges and attempts to load OpenSSL-related files from an hardcoded \nlocation:\n\nC:\\builds\\[PATH OMITTED]\\[REDACTED]\\openssl.cnf\n\nSince this directory does not exist by default, a low-privileged local user can create the missing directory hierarchy \nand place files in a location that is subsequently accessed by the SYSTEM-level process.\nAs a result, files placed in the attacker-controlled directory may be loaded or otherwise processed by wvsc.exe with \nSYSTEM privileges, potentially allowing a local unprivileged attacker to escalate privileges to SYSTEM.\n\nThe issue is therefore an insecure OpenSSL directory/search path combined with an unsafe filesystem permission model.\n\n- Proof of Concept:\n\nThe PoC in the original advisory demonstrates that a low-privileged local user can create the otherwise missing \ndirectory and cause the SYSTEM-level wvsc.exe process to access attacker-controlled OpenSSL-related files from that \nlocation.\n\n- Impact:\n\nA local attacker with low privileges can potentially execute code with SYSTEM-level privileges, depending on the \nOpenSSL-related file being loaded and the execution path reached by wvsc.exe.\n\n- Solution:\n\nThe vendor should remove references to development/build-time paths from production binaries and ensure that all \nOpenSSL-related files are loaded only from trusted, administrator-controlled directories.\n\nAdditionally, filesystem permissions should prevent unprivileged users from creating or modifying directories used by \nprivileged processes.\n\n- Disclosure Timeline:\n\n[18/04/2026] - Vulnerability discovered\n[23/04/2026] - CNA and vendor contacted\n[23/04/2026] - Vulnerability details provided - deadline set at 120 days, in accordance with the CNA disclosure policy\n[ meantime ] - Multiple follow-up attempts by the CNA to the vendor; Invicti Security repeatedly replied with same \nstandard message\n[31/08/2026] - Public disclosure\n\n- CVE Reference:\n\nCVE-2026-6958 has been assigned to this vulnerability.\n\n- Credits:\n\nVulnerability discovered by Andrea Intilangelo\n\n- Original Advisory:\n\nhttps://olografix.org/acme/_poc/CVE-2026-6958.pdf\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:02:40Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/0"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Sep/0"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://olografix.org/acme/_poc/CVE-2026-6958.pdf"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.acunetix.com"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Sep/0"
],
"discovery": "EXTERNAL"
},
"title": "Acunetix 25.11.x - Local Privilege Escalation Vulnerability via OpenSSL Configuration (CVE-2026-6958)",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0160",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/0",
"automated": true,
"contentSha256": "e25146b1aeacd2cf6ba32a2de80dd1d200e8e23a85ddc6f4f22a401c5f753e15",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/0",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-31T10:21:01Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-07T13:35:56Z",
"dateUpdated": "2026-09-09T13:02:40Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0160"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2022-29315 (GCVE-0-2022-29315)
Vulnerability from nvd – Published: 2022-04-19 14:57 – Updated: 2024-08-03 06:17
VLAI
EPSS
VEX
Summary
Invicti Acunetix before 14 allows CSV injection via the Description field on the Add Targets page, if the Export CSV feature is used.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://the-it-wonders.blogspot.com/2022/04/csv-i… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T06:17:54.661Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://the-it-wonders.blogspot.com/2022/04/csv-injection-in-acunetix-version.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Invicti Acunetix before 14 allows CSV injection via the Description field on the Add Targets page, if the Export CSV feature is used."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-04-19T14:57:59.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://the-it-wonders.blogspot.com/2022/04/csv-injection-in-acunetix-version.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2022-29315",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Invicti Acunetix before 14 allows CSV injection via the Description field on the Add Targets page, if the Export CSV feature is used."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://the-it-wonders.blogspot.com/2022/04/csv-injection-in-acunetix-version.html",
"refsource": "MISC",
"url": "https://the-it-wonders.blogspot.com/2022/04/csv-injection-in-acunetix-version.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2022-29315",
"datePublished": "2022-04-19T14:57:59.000Z",
"dateReserved": "2022-04-16T00:00:00.000Z",
"dateUpdated": "2024-08-03T06:17:54.661Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-29315 (GCVE-0-2022-29315)
Vulnerability from cvelistv5 – Published: 2022-04-19 14:57 – Updated: 2024-08-03 06:17
VLAI
EPSS
VEX
Summary
Invicti Acunetix before 14 allows CSV injection via the Description field on the Add Targets page, if the Export CSV feature is used.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://the-it-wonders.blogspot.com/2022/04/csv-i… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T06:17:54.661Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://the-it-wonders.blogspot.com/2022/04/csv-injection-in-acunetix-version.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Invicti Acunetix before 14 allows CSV injection via the Description field on the Add Targets page, if the Export CSV feature is used."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-04-19T14:57:59.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://the-it-wonders.blogspot.com/2022/04/csv-injection-in-acunetix-version.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2022-29315",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Invicti Acunetix before 14 allows CSV injection via the Description field on the Add Targets page, if the Export CSV feature is used."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://the-it-wonders.blogspot.com/2022/04/csv-injection-in-acunetix-version.html",
"refsource": "MISC",
"url": "https://the-it-wonders.blogspot.com/2022/04/csv-injection-in-acunetix-version.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2022-29315",
"datePublished": "2022-04-19T14:57:59.000Z",
"dateReserved": "2022-04-16T00:00:00.000Z",
"dateUpdated": "2024-08-03T06:17:54.661Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}