CVE-2026-89325: Rapid7 Insight Agent: Uncontrolled search path element in InsightVM assessment content leads to local privilege escalation
An uncontrolled search path element in InsightVM assessment content in Rapid7 Insight Agent on Windows allows a local, low-privileged user to execute arbitrary code as SYSTEM via a planted executable resolved from the machine PATH.
Assessment content at or below version 0.0.261.0 included a check that invoked the code command without a fully qualified path from a process running as SYSTEM. The command was resolved against the machine PATH environment variable at execution time. Where the machine PATH contained a directory writable by non-administrative users and ordered ahead of the legitimate Visual Studio Code installation, a local user could place an executable named code in that directory and cause the agent to execute it with SYSTEM privileges.
The version range above refers to InsightVM assessment content versions, not Insight Agent versions. All Insight Agent versions were affected while running assessment content at or below 0.0.261.0. Assessment content is delivered to all Insight Agents via the Rapid7 Insight Platform independently of the Insight Agent version and is not customer-managed.
This issue was resolved in assessment content version 0.0.269.0, which was made generally available on September 15, 2026. Remediation was deployed automatically and no customer action is required.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Rapid7 InsightVM assessment contentto a version that resolves this vulnerability.Fixed in 0.0.269.0
Event History
Frequently Asked Questions
Which systems are actually exposed to exploitation?
A Windows system is exposed if its Insight Agent runs assessment content at or below 0.0.261.0 and the machine PATH contains a directory writable by non-administrative users before the legitimate Visual Studio Code installation. All Insight Agent versions could be affected under those conditions.
What access does an attacker need?
An attacker needs local low-privileged access to the Windows host and the ability to place an executable named code in a non-administrator-writable directory included in the machine PATH. No user interaction is required.
Does updating the Insight Agent itself remediate the issue?
No. The affected component is InsightVM assessment content, which is delivered independently of the Insight Agent version and is not customer-managed. The issue was resolved in assessment content version 0.0.269.0.
What can be checked while waiting for updated assessment content?
Review the machine PATH for directories writable by non-administrative users, particularly entries ordered before the legitimate Visual Studio Code installation. A writable PATH directory in that position allows a local user to plant a code executable that may be run as SYSTEM.