CVE-2026-14172highCWE-250

CVE-2026-14172: falha de alta gravidade em Rapid7 InsightVM

Rapid7 InsightVM, Nexpose, and Insight Agent Local Privilege Escalation via Unvalidated Executable Invocation

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Nexpose+ Monitorar Insight Agent

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.8epss 0.2%
Rapid7 InsightVM, Nexpose, and the Insight Agent execute discovered executables during authenticated assessment without validating file ownership, allowing a local low-privileged user to run code as the scan credential (Scan Engine) or as root/SYSTEM (Insight Agent). Fixed in Scan Engine content 1.1.3935 and Insight Agent content component 0.0.245.0.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
Rapid7 · Insight AgentRapid7 · InsightVMRapid7 · Nexpose
CVEs relacionadas — Rapid7 InsightVM

No mesmo produto, das mais perigosas para as menos.

CVE-2017-5264—CVE-2017-5264EPSS 2.7%CVE-2017-5230—CVE-2017-5230EPSS 1.5%CVE-2022-0757MEDIUMRapid7 Nexpose SQL InjectionEPSS 1.2%CVE-2020-7383MEDIUMSQL Injection in Rapid7 NexposeEPSS 1.1%CVE-2019-5629HIGHCVE-2019-5629EPSS 0.9%CVE-2019-5638HIGHRapid7 Nexpose Insufficient Session ManagementEPSS 0.8%