CVE-2026-14172: Rapid7 Privilege Escalation Vulnerability

CVE-2026-14172 Overview

CVE-2026-14172 affects Rapid7 InsightVM, Nexpose, and the Insight Agent. During authenticated assessments, these products execute discovered executables without validating file ownership. A local low-privileged user can plant a malicious binary on the target host and force the scanner to execute it under elevated context. When executed by the Scan Engine, the code runs as the scan credential. When executed by the Insight Agent, the code runs as root on Linux or SYSTEM on Windows. Rapid7 addressed the flaw in Scan Engine content 1.1.3935 and Insight Agent content component 0.0.245.0. The weakness is classified under [CWE-250] (Execution with Unnecessary Privileges).

Critical Impact
A local unprivileged attacker can escalate to root or SYSTEM by planting binaries the vulnerability scanner later executes with elevated privileges.

Affected Products

Rapid7 InsightVM (Scan Engine content prior to 1.1.3935)
Rapid7 Nexpose (Scan Engine content prior to 1.1.3935)
Rapid7 Insight Agent (content component prior to 0.0.245.0)

Discovery Timeline

2026-07-24 - CVE-2026-14172 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-14172

Vulnerability Analysis

Rapid7 vulnerability management products perform authenticated assessments by discovering installed software and probing binaries on the target host. The scanning workflow invokes executables located in directories enumerated during the assessment. The scanner did not verify that these files were owned by a trusted user before executing them. A local low-privileged user can drop a binary into an inspected path and wait for the scanner or agent to run it.

The Scan Engine executes discovered binaries using the credentials supplied for authenticated scanning, which typically hold administrative rights on the target. The Insight Agent, which runs as a service, executes discovered binaries with its own service context. On Linux hosts the agent runs as root, and on Windows hosts it runs as SYSTEM. Either path grants full control over the host to a user who previously had none.

Root Cause

The defect maps to [CWE-250], Execution with Unnecessary Privileges. The scanning logic invoked target-resident executables in a privileged context without applying an ownership or integrity check. Any file placed in a scanned directory by an unprivileged user became a candidate for execution by a high-privilege process.

Attack Vector

Exploitation requires local access with low privileges on a host that is scanned by InsightVM, Nexpose, or the Insight Agent. The attacker writes a crafted executable to a directory the scanner enumerates. When the scanner or agent next runs, the binary is executed with elevated privileges. User interaction is not required. The attack cannot be launched remotely and depends on the presence of an active scanning workflow or agent on the target.

No verified public proof-of-concept code is available. See the Rapid7 InsightVM Vulnerability Management Release Notes and the Rapid7 Insight Agent Release Notes for vendor-published technical details.

Detection Methods for CVE-2026-14172

Indicators of Compromise

Unexpected child processes spawned by the Rapid7 Scan Engine or ir_agent service, particularly binaries located in user-writable directories.
Newly created executables in directories owned by low-privileged users that coincide with authenticated scan windows.
Privilege transitions where a process launched by the Insight Agent service runs as root or SYSTEM and executes code from a non-standard path.

Detection Strategies

Correlate scan schedule timestamps with process creation events on scanned hosts to identify anomalous executions initiated by the Scan Engine or agent.
Alert on file writes to inspected directories by non-administrative users followed by execution of that file by a Rapid7 service account.
Baseline the expected child-process tree of ir_agent and the Scan Engine, and flag deviations such as shell interpreters, reverse-shell tooling, or credential-dumping utilities.

Monitoring Recommendations

Enable command-line and process-lineage logging on all hosts targeted by authenticated Rapid7 scans, and forward events to a centralized analytics platform.
Monitor writes to common enumeration paths (for example, package manager directories and application install folders) by unprivileged accounts.
Track version metadata of Scan Engine content and Insight Agent content components across the fleet to confirm patch coverage.

How to Mitigate CVE-2026-14172

Immediate Actions Required

Upgrade the Scan Engine content to 1.1.3935 or later across all InsightVM and Nexpose deployments.
Upgrade the Insight Agent content component to 0.0.245.0 or later on every managed endpoint.
Audit scan credentials and rotate any that were used on hosts where untrusted users have shell access.
Inspect scanned hosts for suspicious executables in user-writable directories placed before the patch was applied.

Patch Information

Rapid7 released fixes in Scan Engine content version 1.1.3935 and Insight Agent content component 0.0.245.0. Content updates are distributed automatically to connected consoles and agents, but administrators should verify deployment. Refer to the Rapid7 InsightVM Vulnerability Management Release Notes and the Rapid7 Insight Agent Release Notes for guidance on confirming installed content versions.

Workarounds

Restrict interactive and shell access on hosts scanned with high-privileged credentials until the patch is confirmed installed.
Where feasible, scope scan credentials to the minimum privileges required and avoid running authenticated scans with domain administrator or root-equivalent accounts.
Apply filesystem permissions that prevent unprivileged users from writing to directories enumerated by authenticated scans.

bash

# Verify Insight Agent content component version on Linux
/opt/rapid7/ir_agent/ir_agent --version

# Verify Insight Agent content component version on Windows (PowerShell)
Get-ItemProperty "HKLM:\SOFTWARE\Rapid7\Insight Agent" | Select-Object Version