CVE-2026-6958: Acunetix 25.11.251107123 Local Privilege Escalation via wvsc.exe
Acunetix 25.11.251107123 for Windows contains a local privilege escalation vulnerability in the Web Vulnerability Scanning Engine (wvsc.exe) that allows low-privileged local attackers to execute arbitrary code as SYSTEM by exploiting a missing hardcoded directory path for OpenSSL-related files. Attackers can create the missing directory, place a malicious file at the expected path, and cause the SYSTEM-level wvsc.exe process to load and execute it, resulting in full privilege escalation.
Affected Software
Event History
Frequently Asked Questions
Can this be exploited remotely?
No. The reported attack vector is local: an attacker needs low-privileged access to the affected Windows system.
What access and conditions does an attacker need?
The attacker needs a low-privileged local account and must be able to create the missing directory and place a malicious file at the path expected by wvsc.exe.
Which version is identified as affected?
The report identifies Acunetix for Windows version 25.11.251107123. No information is provided about other versions or configurations.