What’s Vulnerable › Vulnerabilities

CVE-2026-14172: Rapid7 InsightVM, Nexpose, and Insight Agent Local Privilege Escalation via Unvalidated Executable Invocation

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-24 · updated 2026-07-30
• Weakness: CWE-250

Description

Rapid7 InsightVM, Nexpose, and the Insight Agent execute discovered executables during authenticated assessment without validating file ownership, allowing a local low-privileged user to run code as the scan credential (Scan Engine) or as root/SYSTEM (Insight Agent). Fixed in Scan Engine content 1.1.3935 and Insight Agent content component 0.0.245.0.

Affected products

• Rapid7 Insight Agent: before 0.0.245.0 — fixed in 0.0.245.0
• Rapid7 InsightVM: before 1.1.3935 — fixed in 1.1.3935
• Rapid7 Nexpose: before 1.1.3935 — fixed in 1.1.3935

How to fix

Upgrade to a fixed version: Rapid7 Insight Agent 0.0.245.0; Rapid7 InsightVM 1.1.3935; Rapid7 Nexpose 1.1.3935. Check the vendor advisory for mitigations.

References

• https://docs.rapid7.com/insight/release-notes-2026-july/#rapid7-agent-insight-agent
• https://docs.rapid7.com/insight/release-notes-2026-july/#vulnerability-management-insightvm

Get alerted when CVE-2026-14172 or the next vulnerability affects your stack