CVE-2026-6958 in Acunetix
Summary
by MITRE • 09/04/2026
Acunetix 25.11.251107123 for Windows contains a local privilege escalation vulnerability in the Web Vulnerability Scanning Engine (wvsc.exe) that allows low-privileged local attackers to execute arbitrary code as SYSTEM by exploiting a missing hardcoded directory path for OpenSSL-related files. Attackers can create the missing directory, place a malicious file at the expected path, and cause the SYSTEM-level wvsc.exe process to load and execute it, resulting in full privilege escalation.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The vulnerability identified in Acunetix version 25.11.251107123 for Windows represents a critical local privilege escalation flaw within the Web Vulnerability Scanning Engine executable known as wvsc.exe. This component operates with SYSTEM-level privileges, which is necessary for it to perform deep system scans and access restricted resources during security assessments. However, the application fails to properly validate or securely resolve file paths when loading OpenSSL-related dynamic link libraries or configuration files. Specifically, there is a missing hardcoded directory path that leads to an insecure search order where the operating system will traverse directories in a predictable manner if the expected location does not exist. This design flaw allows low-privileged local attackers to manipulate the environment and force the privileged process to load malicious code from a user-writable location instead of the intended secure directory.
From a technical perspective, this vulnerability is classified under CWE-427, which describes Uncontrolled Search Path Element. When wvsc.exe attempts to locate specific OpenSSL files required for its cryptographic operations or scanning functions, it relies on a path that may not be fully qualified or verified against trusted directories if the primary target directory is absent. An attacker with local access can exploit this by creating the missing directory structure at a location they control, such as within their own user profile or a temporary folder. By placing a malicious dynamic link library or executable file in this newly created path with the expected filename, the attacker ensures that when wvsc.exe runs and searches for these files, it encounters the malicious artifact first due to the search order logic of Windows DLL loading mechanisms. Consequently, the SYSTEM-level process loads and executes the attacker's code without any authentication or integrity checks, effectively granting the attacker full control over the system with administrative privileges.
The operational impact of this vulnerability is severe, as it enables a complete compromise of the host machine from a low-privileged user account. Once an attacker achieves execution as NT AUTHORITY\SYSTEM, they can install persistent backdoors, dump credential hashes using tools like Mimikatz, modify security policies, and access sensitive data stored on the system that would otherwise be protected by standard Windows permissions. This escalation path is particularly dangerous in enterprise environments where Acunetix may be deployed for regular vulnerability scanning, as it turns a trusted administrative tool into an attack vector against itself. The attacker does not need to exploit any network-facing services or remote code execution flaws; local access alone is sufficient to achieve full system compromise, making this a high-risk issue for organizations relying on automated security tools that run with elevated privileges.
In terms of industry standards and threat modeling, this vulnerability aligns closely with the MITRE ATT&CK technique T1055.008, which covers Process Injection via DLL Search Order Hijacking. It also reflects common pitfalls in application development where developers assume default paths are secure or fail to implement strict file path validation using functions like GetFullPathName combined with integrity checks such as digital signature verification before loading external modules. The lack of these safeguards allows the attacker to hijack the execution flow of a privileged process, which is a classic pattern for privilege escalation on Windows platforms. Security teams should recognize this behavior as indicative of poor secure coding practices regarding resource management and path resolution in applications that operate with high-level permissions.
To mitigate this vulnerability, immediate action is required from both Acunetix developers and system administrators. The vendor must update the application to ensure all file paths are fully qualified and validated before use, implementing strict directory traversal checks to prevent loading files from untrusted locations. Additionally, applying digital signature verification for any loaded DLLs or executables would significantly reduce the risk of successful hijacking even if a malicious file is placed in an expected path. For administrators currently running vulnerable versions, it is recommended to restrict local access to accounts that have permission to execute wvsc.exe and ensure that user profiles are not writable by standard users where possible. Regular patching of Acunetix installations should be prioritized once the vendor releases a fixed version that addresses this insecure search path issue, thereby closing the privilege escalation vector entirely.