CVE-2026-6958: Acunetix Privilege Escalation Vulnerability

CVE-2026-6958 Overview

CVE-2026-6958 is a local privilege escalation vulnerability affecting Acunetix 25.11.251107123 for Windows. The flaw resides in the Web Vulnerability Scanning Engine (wvsc.exe), which runs with SYSTEM privileges. The engine attempts to load OpenSSL-related files from a hardcoded directory path that does not exist by default. Low-privileged local attackers can create the missing directory, drop a malicious file at the expected location, and cause wvsc.exe to load and execute it as SYSTEM. This uncontrolled search path element issue [CWE-427] results in full local privilege escalation on affected Windows hosts.

Critical Impact
A low-privileged local user can escalate to SYSTEM by planting a malicious OpenSSL-related file in a writable, hardcoded directory loaded by wvsc.exe.

Affected Products

Acunetix 25.11.251107123 for Windows
Acunetix Web Vulnerability Scanning Engine (wvsc.exe)
Prior Acunetix 25.x builds sharing the same hardcoded OpenSSL path behavior

Discovery Timeline

2026-09-04 - CVE-2026-6958 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-6958

Vulnerability Analysis

The vulnerability originates in how wvsc.exe resolves and loads OpenSSL-related files at runtime. The scanning engine references a hardcoded absolute path that Acunetix does not create during installation. Because the parent directory is missing, standard Windows access control does not protect it. A low-privileged local user can create the directory tree and populate it with attacker-controlled content.

When wvsc.exe runs under the SYSTEM account, it reads from that attacker-controlled path and executes the planted file in its own security context. The result is arbitrary code execution as SYSTEM from an unprivileged starting position. The issue is classified under [CWE-427] (Uncontrolled Search Path Element).

Root Cause

The root cause is trust in an unverified filesystem path. The Acunetix engine assumes the hardcoded OpenSSL directory is either absent (in which case loading fails safely) or populated only by a privileged installer. It does not validate that the directory and its contents were created by a trusted principal. This allows any authenticated local user with write access to the parent path to influence what SYSTEM-level code loads.

Attack Vector

Exploitation requires local access with low privileges. The attacker performs three steps: create the missing directory referenced by wvsc.exe, place a malicious payload at the expected filename, and trigger or wait for the SYSTEM-level scanner process to load it. No user interaction from an administrator is required, and network access is not needed. Refer to the Olografix CVE-2026-6958 PoC and the VulnCheck Acunetix Privilege Escalation Advisory for reproduction details.

No verified exploit code is provided. See the referenced advisories for technical proof-of-concept details.

Detection Methods for CVE-2026-6958

Indicators of Compromise

Creation of the hardcoded OpenSSL directory tree by a non-administrative user account on hosts running Acunetix.
Presence of unsigned or unexpected DLL, configuration, or OpenSSL-related files inside that directory.
wvsc.exe loading modules from a user-writable path outside the Acunetix installation directory.
Child processes of wvsc.exe running as NT AUTHORITY\SYSTEM that spawn shells, script interpreters, or credential-access tools.

Detection Strategies

Baseline the Acunetix installation directory and alert on any file writes originating from non-administrative users near paths consumed by wvsc.exe.
Monitor Windows Sysmon Event ID 11 (FileCreate) for directory or file creation matching the hardcoded OpenSSL path used by the scanner.
Correlate Sysmon Event ID 7 (ImageLoad) events for wvsc.exe loading modules from unusual, user-writable locations.
Alert on process ancestry where wvsc.exe running as SYSTEM launches non-standard child processes.

Monitoring Recommendations

Enable command-line and module-load logging on all Windows hosts that run Acunetix scanners.
Forward Sysmon, Windows Security, and EDR telemetry to a central data lake for retention and correlation.
Track privilege elevation events where a low-privileged session subsequently obtains SYSTEM-level actions.

How to Mitigate CVE-2026-6958

Immediate Actions Required

Inventory all Windows hosts running Acunetix 25.11.251107123 and identify which local accounts have interactive or session access.
Restrict local logon on hosts running Acunetix to administrators and trusted scanner operators only.
Pre-create the hardcoded OpenSSL directory referenced by wvsc.exe and apply an ACL that denies write access to non-administrative users.
Audit the directory for any unexpected files before applying protective ACLs.

Patch Information

No vendor patch is referenced in the NVD entry at publication. Consult the Acunetix Security Tools Overview and the VulnCheck Acunetix Privilege Escalation Advisory for the current fixed build. Upgrade to the vendor-supplied release that removes the hardcoded path or validates the loaded content once available. The Full Disclosure September 2026 post provides additional context.

Workarounds

Manually create the referenced OpenSSL directory as an administrator, then apply an ACL granting write permissions only to SYSTEM and Administrators.
Limit which users can start or interact with the Acunetix scanner service on shared hosts.
Run Acunetix on dedicated scanning hosts that do not permit general user logons.
Apply application allowlisting so that only signed, vendor-approved binaries can be loaded by wvsc.exe.

bash

# Example: restrict ACL on the pre-created OpenSSL directory (run as Administrator)
icacls "C:\Path\To\HardcodedOpenSSLDir" /inheritance:r
icacls "C:\Path\To\HardcodedOpenSSLDir" /grant:r "SYSTEM:(OI)(CI)F" "Administrators:(OI)(CI)F"
icacls "C:\Path\To\HardcodedOpenSSLDir" /remove "Users" "Authenticated Users"