CVE-2026-89325: Rapid7 Insight Agent Privilege Escalation

CVE-2026-89325 Overview

CVE-2026-89325 is an uncontrolled search path element vulnerability [CWE-427] in Rapid7 Insight Agent on Windows. The flaw exists in InsightVM assessment content at or below version 0.0.261.0. A SYSTEM-level process invokes the code command without a fully qualified path, resolving it against the machine PATH environment variable at runtime.

A local, low-privileged user can exploit this behavior to execute arbitrary code as SYSTEM. The attack requires a writable directory on the machine PATH ordered ahead of the legitimate Visual Studio Code installation. Rapid7 resolved the issue in assessment content version 0.0.269.0, released on September 15, 2026.

Critical Impact
Local attackers with low privileges can achieve SYSTEM-level code execution on affected Windows endpoints by planting a malicious code executable in a writable PATH directory.

Affected Products

Rapid7 Insight Agent on Windows (all versions) running InsightVM assessment content at or below version 0.0.261.0
Windows systems with a non-administrator-writable directory ordered ahead of Visual Studio Code in the machine PATH
Environments relying on Rapid7 Insight Platform assessment content delivery

Discovery Timeline

September 15, 2026 - Rapid7 releases assessment content version 0.0.269.0 with automatic remediation
September 24, 2026 - CVE-2026-89325 published to NVD
September 26, 2026 - Last updated in NVD database

Technical Details for CVE-2026-89325

Vulnerability Analysis

The vulnerability stems from an InsightVM assessment check that invokes the code binary without specifying its absolute path. The Insight Agent runs as SYSTEM on Windows, so any child process it spawns inherits SYSTEM privileges. When Windows resolves an unqualified executable name, it searches directories listed in the PATH environment variable in order.

If the machine PATH contains a directory writable by non-administrative users ordered ahead of the Visual Studio Code install directory, Windows resolves code to the attacker-controlled binary. The SYSTEM-level agent then launches that binary, giving the attacker arbitrary code execution at the highest privilege level.

The scope is broad because assessment content is delivered independently of the Insight Agent version via the Rapid7 Insight Platform. All Insight Agent versions were affected while running vulnerable assessment content. Customers cannot manage or override the assessment content directly.

Root Cause

The root cause is a classic uncontrolled search path element issue [CWE-427]. The assessment logic calls code as a bare command name rather than invoking the fully qualified path to the Visual Studio Code executable. This defers executable resolution to the Windows loader, which trusts the PATH ordering configured on the host.

Attack Vector

Exploitation requires local, low-privileged access to a Windows host running the Insight Agent. The attacker must identify a directory on the machine PATH that permits write access for non-admin users and sits before the legitimate Visual Studio Code directory. The attacker drops an executable named code.exe into that directory and waits for the agent to run the vulnerable assessment check.

Common preconditions include misconfigured application install directories, third-party software that adds world-writable paths, or administrator-created directories with permissive ACLs. No network access, user interaction, or elevated privileges are required beyond standard local user rights.

No verified public exploit code is available. See the Rapid7 Release Notes - CVE-2026-89325 for vendor details.

Detection Methods for CVE-2026-89325

Indicators of Compromise

Unexpected code.exe processes spawned as a child of the Rapid7 Insight Agent service running under the SYSTEM account
Presence of code or code.exe binaries in non-standard directories listed in the machine PATH
Writable directories on the machine PATH with ACLs permitting standard users to create files
Process execution events where the parent is Rapid7 Insight Agent and the child image path resides outside the legitimate Visual Studio Code install directory

Detection Strategies

Enumerate the machine PATH and audit each directory for ACLs granting write access to non-administrator principals using icacls or PowerShell
Hunt for process creation events (Windows Event ID 4688 or Sysmon Event ID 1) where SYSTEM invokes code.exe from unexpected paths
Correlate Insight Agent service activity with child process launches to detect anomalous SYSTEM-level executions

Monitoring Recommendations

Enable command-line auditing and Sysmon process creation logging on all Windows endpoints running the Insight Agent
Alert on new executables named code.exe created in user-writable directories
Monitor changes to the machine PATH environment variable, which should require administrative privilege

How to Mitigate CVE-2026-89325

Immediate Actions Required

Confirm that the Insight Agent is receiving assessment content version 0.0.269.0 or later from the Rapid7 Insight Platform
Audit the machine PATH on all Windows hosts and remove or restrict any directory writable by non-administrative users
Review historical process execution telemetry for suspicious SYSTEM-level invocations of code.exe from unexpected paths

Patch Information

Rapid7 resolved CVE-2026-89325 in InsightVM assessment content version 0.0.269.0, made generally available on September 15, 2026. Remediation was deployed automatically through the Rapid7 Insight Platform and no customer action is required to receive the fixed assessment content. See the Rapid7 Release Notes - CVE-2026-89325 for full details.

Workarounds

Harden the machine PATH by removing all non-administrator-writable directories and placing trusted application directories first
Apply restrictive NTFS ACLs to any directory that must appear in the machine PATH so that only administrators can create or modify files
Validate that Visual Studio Code is installed to a protected location and that its directory precedes any user-controlled entries in PATH