CVE-2026-14172: Rapid7 InsightVM, Nexpose, and Insight Agent Local Privilege Escalation via Unvalidated Executable Invocation
Rapid7 InsightVM, Nexpose, and the Insight Agent execute discovered executables during authenticated assessment without validating file ownership, allowing a local low-privileged user to run code as the scan credential (Scan Engine) or as root/SYSTEM (Insight Agent). Fixed in Scan Engine content 1.1.3935 and Insight Agent content component 0.0.245.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Scan Engine content (InsightVM/Nexpose)to a version that resolves this vulnerability.Fixed in 1.1.3935 - Upgrade
Upgrade
Insight Agent content componentto a version that resolves this vulnerability.Fixed in 0.0.245.0 - Compensating control
For air-gapped or offline deployments, apply the corresponding content update via the offline content update process (Scan Engine content >= 1.1.3935 and Insight Agent content component >= 0.0.245.0).
- Compensating control
For internet-connected deployments, allow the fixes to be delivered automatically via content updates (Scan Engine content >= 1.1.3935 and Insight Agent content component >= 0.0.245.0).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-14172?
The severity of CVE-2026-14172 is classified as high with a CVSS score of 7.8.
How does CVE-2026-14172 impact Rapid7 InsightVM users?
CVE-2026-14172 allows local low-privileged users to escalate privileges and execute code as the scan credentials or as root/SYSTEM.
How do I fix CVE-2026-14172?
To resolve CVE-2026-14172, upgrade to the fix provided in Scan Engine content version 1.1 or later.
What software is affected by CVE-2026-14172?
CVE-2026-14172 affects Rapid7 InsightVM, Rapid7 Nexpose, and the Rapid7 Insight Agent.
When was CVE-2026-14172 published?
CVE-2026-14172 was published on July 24, 2026.