CVE-2026-14172 (GCVE-0-2026-14172)

Vulnerability from cvelistv5 – Published: 2026-07-24 05:51 – Updated: 2026-07-24 12:28
VLAI
Title
Rapid7 InsightVM, Nexpose, and Insight Agent Local Privilege Escalation via Unvalidated Executable Invocation
Summary
Rapid7 InsightVM, Nexpose, and the Insight Agent execute discovered executables during authenticated assessment without validating file ownership, allowing a local low-privileged user to run code as the scan credential (Scan Engine) or as root/SYSTEM (Insight Agent). Fixed in Scan Engine content 1.1.3935 and Insight Agent content component 0.0.245.0.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
  • CWE-250 - Execution with Unnecessary Privileges
Assigner
References
Impacted products
Vendor Product Version
Rapid7 InsightVM Affected: 0 , < 1.1.3935 (custom)
Create a notification for this product.
Rapid7 Nexpose Affected: 0 , < 1.1.3935 (custom)
Create a notification for this product.
Rapid7 Insight Agent Affected: 0 , < 0.0.245.0 (custom)
Create a notification for this product.
Credits
Paul Miseiko of Rapid7 Patrick Fitzsimons of Rapid7
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-14172",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-24T12:28:26.602727Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-24T12:28:35.484Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows",
            "Linux",
            "macOS"
          ],
          "product": "InsightVM",
          "vendor": "Rapid7",
          "versions": [
            {
              "lessThan": "1.1.3935",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows",
            "Linux",
            "macOS"
          ],
          "product": "Nexpose",
          "vendor": "Rapid7",
          "versions": [
            {
              "lessThan": "1.1.3935",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows",
            "Linux",
            "macOS"
          ],
          "product": "Insight Agent",
          "vendor": "Rapid7",
          "versions": [
            {
              "lessThan": "0.0.245.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Paul Miseiko of Rapid7"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Patrick Fitzsimons of Rapid7"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eRapid7 InsightVM, Nexpose, and the Insight Agent execute discovered executables during authenticated assessment without validating file ownership, allowing a local low-privileged user to run code as the scan credential (Scan Engine) or as root/SYSTEM (Insight Agent). Fixed in Scan Engine content 1.1.3935 and Insight Agent content component 0.0.245.0.\u003c/p\u003e"
            }
          ],
          "value": "Rapid7 InsightVM, Nexpose, and the Insight Agent execute discovered executables during authenticated assessment without validating file ownership, allowing a local low-privileged user to run code as the scan credential (Scan Engine) or as root/SYSTEM (Insight Agent). Fixed in Scan Engine content 1.1.3935 and Insight Agent content component 0.0.245.0."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "An unprivileged local user can achieve arbitrary code execution as root (Linux/macOS) or SYSTEM (Windows) via the Insight Agent, or as the configured scan credential identity via the Scan Engine, by planting a malicious executable in a user-writable directory that is then discovered and executed during assessment data collection."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-250",
              "description": "CWE-250 Execution with Unnecessary Privileges",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-24T06:05:31.460Z",
        "orgId": "9974b330-7714-4307-a722-5648477acda7",
        "shortName": "rapid7"
      },
      "references": [
        {
          "name": "Rapid7 InsightVM Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://docs.rapid7.com/insight/release-notes-2026-july/#vulnerability-management-insightvm"
        },
        {
          "name": "Rapid7 Insight Agent Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://docs.rapid7.com/insight/release-notes-2026-july/#rapid7-agent-insight-agent"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUpdate to Scan Engine content version 1.1.3935 or later (InsightVM and Nexpose) and Insight Agent content component version 0.0.245.0 or later. Internet-connected deployments receive these fixes automatically via content updates. Air-gapped or offline deployments should apply the corresponding content update via the offline content update process.\u003c/p\u003e"
            }
          ],
          "value": "Update to Scan Engine content version 1.1.3935 or later (InsightVM and Nexpose) and Insight Agent content component version 0.0.245.0 or later. Internet-connected deployments receive these fixes automatically via content updates. Air-gapped or offline deployments should apply the corresponding content update via the offline content update process."
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Rapid7 InsightVM, Nexpose, and Insight Agent Local Privilege Escalation via Unvalidated Executable Invocation",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9974b330-7714-4307-a722-5648477acda7",
    "assignerShortName": "rapid7",
    "cveId": "CVE-2026-14172",
    "datePublished": "2026-07-24T05:51:14.326Z",
    "dateReserved": "2026-06-30T06:49:55.764Z",
    "dateUpdated": "2026-07-24T12:28:35.484Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-14172",
      "date": "2026-07-24",
      "epss": "0.00107",
      "percentile": "0.01315"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-14172\",\"sourceIdentifier\":\"cve@rapid7.com\",\"published\":\"2026-07-24T07:16:32.977\",\"lastModified\":\"2026-07-24T13:17:24.223\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Rapid7 InsightVM, Nexpose, and the Insight Agent execute discovered executables during authenticated assessment without validating file ownership, allowing a local low-privileged user to run code as the scan credential (Scan Engine) or as root/SYSTEM (Insight Agent). Fixed in Scan Engine content 1.1.3935 and Insight Agent content component 0.0.245.0.\"}],\"affected\":[{\"source\":\"cve@rapid7.com\",\"affectedData\":[{\"vendor\":\"Rapid7\",\"product\":\"InsightVM\",\"defaultStatus\":\"unaffected\",\"platforms\":[\"Windows\",\"Linux\",\"macOS\"],\"versions\":[{\"version\":\"0\",\"lessThan\":\"1.1.3935\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Rapid7\",\"product\":\"Nexpose\",\"defaultStatus\":\"unaffected\",\"platforms\":[\"Windows\",\"Linux\",\"macOS\"],\"versions\":[{\"version\":\"0\",\"lessThan\":\"1.1.3935\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Rapid7\",\"product\":\"Insight Agent\",\"defaultStatus\":\"unaffected\",\"platforms\":[\"Windows\",\"Linux\",\"macOS\"],\"versions\":[{\"version\":\"0\",\"lessThan\":\"0.0.245.0\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"cve@rapid7.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-07-24T12:28:26.602727Z\",\"id\":\"CVE-2026-14172\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"cve@rapid7.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-250\"}]}],\"references\":[{\"url\":\"https://docs.rapid7.com/insight/release-notes-2026-july/#rapid7-agent-insight-agent\",\"source\":\"cve@rapid7.com\"},{\"url\":\"https://docs.rapid7.com/insight/release-notes-2026-july/#vulnerability-management-insightvm\",\"source\":\"cve@rapid7.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-14172\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-07-24T12:28:26.602727Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-07-24T12:28:32.202Z\"}}], \"cna\": {\"title\": \"Rapid7 InsightVM, Nexpose, and Insight Agent Local Privilege Escalation via Unvalidated Executable Invocation\", \"source\": {\"discovery\": \"INTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Paul Miseiko of Rapid7\"}, {\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Patrick Fitzsimons of Rapid7\"}], \"impacts\": [{\"descriptions\": [{\"lang\": \"en\", \"value\": \"An unprivileged local user can achieve arbitrary code execution as root (Linux/macOS) or SYSTEM (Windows) via the Insight Agent, or as the configured scan credential identity via the Scan Engine, by planting a malicious executable in a user-writable directory that is then discovered and executed during assessment data collection.\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Rapid7\", \"product\": \"InsightVM\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"1.1.3935\", \"versionType\": \"custom\"}], \"platforms\": [\"Windows\", \"Linux\", \"macOS\"], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Rapid7\", \"product\": \"Nexpose\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"1.1.3935\", \"versionType\": \"custom\"}], \"platforms\": [\"Windows\", \"Linux\", \"macOS\"], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Rapid7\", \"product\": \"Insight Agent\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"0.0.245.0\", \"versionType\": \"custom\"}], \"platforms\": [\"Windows\", \"Linux\", \"macOS\"], \"defaultStatus\": \"unaffected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Update to Scan Engine content version 1.1.3935 or later (InsightVM and Nexpose) and Insight Agent content component version 0.0.245.0 or later. Internet-connected deployments receive these fixes automatically via content updates. Air-gapped or offline deployments should apply the corresponding content update via the offline content update process.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eUpdate to Scan Engine content version 1.1.3935 or later (InsightVM and Nexpose) and Insight Agent content component version 0.0.245.0 or later. Internet-connected deployments receive these fixes automatically via content updates. Air-gapped or offline deployments should apply the corresponding content update via the offline content update process.\u003c/p\u003e\", \"base64\": false}]}], \"references\": [{\"url\": \"https://docs.rapid7.com/insight/release-notes-2026-july/#vulnerability-management-insightvm\", \"name\": \"Rapid7 InsightVM Release Notes\", \"tags\": [\"release-notes\"]}, {\"url\": \"https://docs.rapid7.com/insight/release-notes-2026-july/#rapid7-agent-insight-agent\", \"name\": \"Rapid7 Insight Agent Release Notes\", \"tags\": [\"release-notes\"]}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.2\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Rapid7 InsightVM, Nexpose, and the Insight Agent execute discovered executables during authenticated assessment without validating file ownership, allowing a local low-privileged user to run code as the scan credential (Scan Engine) or as root/SYSTEM (Insight Agent). Fixed in Scan Engine content 1.1.3935 and Insight Agent content component 0.0.245.0.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eRapid7 InsightVM, Nexpose, and the Insight Agent execute discovered executables during authenticated assessment without validating file ownership, allowing a local low-privileged user to run code as the scan credential (Scan Engine) or as root/SYSTEM (Insight Agent). Fixed in Scan Engine content 1.1.3935 and Insight Agent content component 0.0.245.0.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-250\", \"description\": \"CWE-250 Execution with Unnecessary Privileges\"}]}], \"providerMetadata\": {\"orgId\": \"9974b330-7714-4307-a722-5648477acda7\", \"shortName\": \"rapid7\", \"dateUpdated\": \"2026-07-24T06:05:31.460Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-14172\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-24T12:28:35.484Z\", \"dateReserved\": \"2026-06-30T06:49:55.764Z\", \"assignerOrgId\": \"9974b330-7714-4307-a722-5648477acda7\", \"datePublished\": \"2026-07-24T05:51:14.326Z\", \"assignerShortName\": \"rapid7\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.