{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Acunetix",
          "vendor": "Invicti",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Andrea Intilangelo"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Acunetix 25.11.x - Local Privilege Escalation Vulnerability via OpenSSL Configuration (CVE-2026-6958)\n\n- Software Link:\n\nhttps://www.acunetix.com\n\n- Affected Versions:\n\nVersion 25.11.x (tested on Microsoft Windows 11 and 11 IoT Enterprise LTSC)\nOther versions may be affected as well.\n\n- Vulnerability Description:\n\nA local privilege escalation vulnerability has been identified in Acunetix (Web Vulnerability Scanner, or abbreviated \nAWVS) 25.11.x\nThe vulnerability is caused by the use of a hardcoded OpenSSL-related directory path that does not exist by default and \nis writable by low-privileged users.\nThe affected binary, wvsc.exe, runs with SYSTEM privileges and attempts to load OpenSSL-related files from an hardcoded \nlocation:\n\nC:\\builds\\[PATH OMITTED]\\[REDACTED]\\openssl.cnf\n\nSince this directory does not exist by default, a low-privileged local user can create the missing directory hierarchy \nand place files in a location that is subsequently accessed by the SYSTEM-level process.\nAs a result, files placed in the attacker-controlled directory may be loaded or otherwise processed by wvsc.exe with \nSYSTEM privileges, potentially allowing a local unprivileged attacker to escalate privileges to SYSTEM.\n\nThe issue is therefore an insecure OpenSSL directory/search path combined with an unsafe filesystem permission model.\n\n- Proof of Concept:\n\nThe PoC in the original advisory demonstrates that a low-privileged local user can create the otherwise missing \ndirectory and cause the SYSTEM-level wvsc.exe process to access attacker-controlled OpenSSL-related files from that \nlocation.\n\n- Impact:\n\nA local attacker with low privileges can potentially execute code with SYSTEM-level privileges, depending on the \nOpenSSL-related file being loaded and the execution path reached by wvsc.exe.\n\n- Solution:\n\nThe vendor should remove references to development/build-time paths from production binaries and ensure that all \nOpenSSL-related files are loaded only from trusted, administrator-controlled directories.\n\nAdditionally, filesystem permissions should prevent unprivileged users from creating or modifying directories used by \nprivileged processes.\n\n- Disclosure Timeline:\n\n[18/04/2026] - Vulnerability discovered\n[23/04/2026] - CNA and vendor contacted\n[23/04/2026] - Vulnerability details provided - deadline set at 120 days, in accordance with the CNA disclosure policy\n[ meantime ] - Multiple follow-up attempts by the CNA to the vendor; Invicti Security repeatedly replied with same \nstandard message\n[31/08/2026] - Public disclosure\n\n- CVE Reference:\n\nCVE-2026-6958 has been assigned to this vulnerability.\n\n- Credits:\n\nVulnerability discovered by Andrea Intilangelo\n\n- Original Advisory:\n\nhttps://olografix.org/acme/_poc/CVE-2026-6958.pdf\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:02:40Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/0"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/0"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://olografix.org/acme/_poc/CVE-2026-6958.pdf"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.acunetix.com"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/0"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Acunetix 25.11.x - Local Privilege Escalation Vulnerability via OpenSSL Configuration (CVE-2026-6958)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0160",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/0",
            "automated": true,
            "contentSha256": "e25146b1aeacd2cf6ba32a2de80dd1d200e8e23a85ddc6f4f22a401c5f753e15",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/0",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-31T10:21:01Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:35:56Z",
    "dateUpdated": "2026-09-09T13:02:40Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0160"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}