CVE-2026-14172 in InsightVM
Summary
by MITRE • 07/24/2026
Rapid7 InsightVM, Nexpose, and the Insight Agent execute discovered executables during authenticated assessment without validating file ownership, allowing a local low-privileged user to run code as the scan credential (Scan Engine) or as root/SYSTEM (Insight Agent). Fixed in Scan Engine content 1.1.3935 and Insight Agent content component 0.0.245.0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/24/2026
This vulnerability exists within Rapid7's security assessment tools including InsightVM, Nexpose, and the Insight Agent where the software executes discovered executables during authenticated assessments without proper validation of file ownership. The flaw stems from insufficient access control mechanisms that fail to verify whether the executing user has appropriate permissions over the target executable files. This represents a classic privilege escalation vulnerability that can be exploited by local low-privileged users to gain elevated system privileges.
The technical implementation of this vulnerability involves the software's assessment engine performing automated discovery and execution of binaries without performing ownership checks or permission validations before execution. When an authenticated scan is conducted, the system may encounter executable files that are owned by different users or groups than the scanning process. The absence of file ownership validation creates an opportunity for malicious actors to place specially crafted executables in locations accessible to the scanning process, potentially leading to code execution with the privileges of the scan credential.
From an operational perspective, this vulnerability presents significant risk as it can be exploited to execute arbitrary code with elevated privileges. When exploited against the Scan Engine, a local low-privileged user could run code as the scan credential, which typically has elevated permissions for system scanning operations. In cases where the Insight Agent is running with root or SYSTEM privileges, successful exploitation could result in complete system compromise. The vulnerability affects both the assessment engine functionality and the agent execution components, creating multiple attack vectors for potential exploitation.
The fix implemented in Scan Engine content version 1.1.3935 addresses this issue by introducing proper file ownership validation before executable execution during assessment processes. The Insight Agent content component version 0.0.245.0 includes similar protections to ensure that discovered executables are validated for appropriate ownership and permissions before execution. This remediation aligns with security best practices outlined in the CWE-732 category which focuses on Incorrect Permission Assignment for Critical Resources, and follows ATT&CK techniques related to privilege escalation through abuse of system permissions. Organizations should immediately update to these patched versions to mitigate the risk of local privilege escalation attacks targeting these security assessment tools.