GCVE-1988-2026-0172
Vulnerability from gna-1988 – Published: 2026-09-08 07:25 – Updated: 2026-09-09 13:02
VLAI
EPSS
VEX
Title
Acunetix 25.11.x - Local Privilege Escalation Vulnerability via OpenSSL Configuration (CVE-2026-6958)
Summary
Acunetix 25.11.x - Local Privilege Escalation Vulnerability via OpenSSL Configuration (CVE-2026-6958)
- Software Link:
https://www.acunetix.com
- Affected Versions:
Version 25.11.x (tested on Microsoft Windows 11 and 11 IoT Enterprise LTSC)
Other versions may be affected as well.
- Vulnerability Description:
A local privilege escalation vulnerability has been identified in Acunetix (Web Vulnerability Scanner, or abbreviated
AWVS) 25.11.x
The vulnerability is caused by the use of a hardcoded OpenSSL-related directory path that does not exist by default and
is writable by low-privileged users.
The affected binary, wvsc.exe, runs with SYSTEM privileges and attempts to load OpenSSL-related files from an hardcoded
location:
C:\builds\[PATH OMITTED]\[REDACTED]\openssl.cnf
Since this directory does not exist by default, a low-privileged local user can create the missing directory hierarchy
and place files in a location that is subsequently accessed by the SYSTEM-level process.
As a result, files placed in the attacker-controlled directory may be loaded or otherwise processed by wvsc.exe with
SYSTEM privileges, potentially allowing a local unprivileged attacker to escalate privileges to SYSTEM.
The issue is therefore an insecure OpenSSL directory/search path combined with an unsafe filesystem permission model.
- Proof of Concept:
The PoC in the original advisory demonstrates that a low-privileged local user can create the otherwise missing
directory and cause the SYSTEM-level wvsc.exe process to access attacker-controlled OpenSSL-related files from that
location.
- Impact:
A local attacker with low privileges can potentially execute code with SYSTEM-level privileges, depending on the
OpenSSL-related file being loaded and the execution path reached by wvsc.exe.
- Solution:
The vendor should remove references to development/build-time paths from production binaries and ensure that all
OpenSSL-related files are loaded only from trusted, administrator-controlled directories.
Additionally, filesystem permissions should prevent unprivileged users from creating or modifying directories used by
privileged processes.
- Disclosure Timeline:
[18/04/2026] - Vulnerability discovered
[23/04/2026] - CNA and vendor contacted
[23/04/2026] - Vulnerability details provided - deadline set at 120 days, in accordance with the CNA disclosure policy
[ meantime ] - Multiple follow-up attempts by the CNA to the vendor; Invicti Security repeatedly replied with same
standard message
[31/08/2026] - Public disclosure
- CVE Reference:
CVE-2026-6958 has been assigned to this vulnerability.
- Credits:
Vulnerability discovered by Andrea Intilangelo
- Original Advisory:
https://olografix.org/acme/_poc/CVE-2026-6958.pdf
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
6 references
Impacted products
Relationships
reference
GCVE-1988-2026-0172 (this record)
- related CVE-2026-6958
{
"containers": {
"cna": {
"affected": [
{
"product": "Acunetix",
"vendor": "Invicti",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Andrea Intilangelo"
}
],
"descriptions": [
{
"lang": "en",
"value": "Acunetix 25.11.x - Local Privilege Escalation Vulnerability via OpenSSL Configuration (CVE-2026-6958)\n\n- Software Link:\n\nhttps://www.acunetix.com\n\n- Affected Versions:\n\nVersion 25.11.x (tested on Microsoft Windows 11 and 11 IoT Enterprise LTSC)\nOther versions may be affected as well.\n\n- Vulnerability Description:\n\nA local privilege escalation vulnerability has been identified in Acunetix (Web Vulnerability Scanner, or abbreviated \nAWVS) 25.11.x\nThe vulnerability is caused by the use of a hardcoded OpenSSL-related directory path that does not exist by default and \nis writable by low-privileged users.\nThe affected binary, wvsc.exe, runs with SYSTEM privileges and attempts to load OpenSSL-related files from an hardcoded \nlocation:\n\nC:\\builds\\[PATH OMITTED]\\[REDACTED]\\openssl.cnf\n\nSince this directory does not exist by default, a low-privileged local user can create the missing directory hierarchy \nand place files in a location that is subsequently accessed by the SYSTEM-level process.\nAs a result, files placed in the attacker-controlled directory may be loaded or otherwise processed by wvsc.exe with \nSYSTEM privileges, potentially allowing a local unprivileged attacker to escalate privileges to SYSTEM.\n\nThe issue is therefore an insecure OpenSSL directory/search path combined with an unsafe filesystem permission model.\n\n- Proof of Concept:\n\nThe PoC in the original advisory demonstrates that a low-privileged local user can create the otherwise missing \ndirectory and cause the SYSTEM-level wvsc.exe process to access attacker-controlled OpenSSL-related files from that \nlocation.\n\n- Impact:\n\nA local attacker with low privileges can potentially execute code with SYSTEM-level privileges, depending on the \nOpenSSL-related file being loaded and the execution path reached by wvsc.exe.\n\n- Solution:\n\nThe vendor should remove references to development/build-time paths from production binaries and ensure that all \nOpenSSL-related files are loaded only from trusted, administrator-controlled directories.\n\nAdditionally, filesystem permissions should prevent unprivileged users from creating or modifying directories used by \nprivileged processes.\n\n- Disclosure Timeline:\n\n[18/04/2026] - Vulnerability discovered\n[23/04/2026] - CNA and vendor contacted\n[23/04/2026] - Vulnerability details provided - deadline set at 120 days, in accordance with the CNA disclosure policy\n[ meantime ] - Multiple follow-up attempts by the CNA to the vendor; Invicti Security repeatedly replied with same \nstandard message\n[31/08/2026] - Public disclosure\n\n- CVE Reference:\n\nCVE-2026-6958 has been assigned to this vulnerability.\n\n- Credits:\n\nVulnerability discovered by Andrea Intilangelo\n\n- Original Advisory:\n\nhttps://olografix.org/acme/_poc/CVE-2026-6958.pdf\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:02:40Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/0"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Sep/0"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://olografix.org/acme/_poc/CVE-2026-6958.pdf"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.acunetix.com"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Sep/0"
],
"discovery": "EXTERNAL"
},
"title": "Acunetix 25.11.x - Local Privilege Escalation Vulnerability via OpenSSL Configuration (CVE-2026-6958)",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2026-6958",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0172",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/0",
"automated": true,
"contentSha256": "e25146b1aeacd2cf6ba32a2de80dd1d200e8e23a85ddc6f4f22a401c5f753e15",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/0",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-31T10:21:01Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0172"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-08T07:25:42Z",
"dateUpdated": "2026-09-09T13:02:40Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0172"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…