High 7.8Published Jul 24, 2026

CVE-2026-14172Rapid7 InsightVM, Nexpose, and Insight Agent Local Privilege Escalation via Unvalidated Executable Invocation

Updated under an hour ago (Oct 27, 2026, 8:40 PM ET)

Does this affect you?

It affects Rapid7 InsightVM and 2 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Rapid7 InsightVM

Exploited in the last 30 days

Rapid7 InsightVM, Nexpose, and the Insight Agent execute discovered executables during authenticated assessment without validating file ownership, allowing a local low-privileged user to run code as the scan credential (Scan Engine) or as root/SYSTEM (Insight Agent). Fixed in Scan Engine content 1.1.3935 and Insight Agent content component 0.0.245.0.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-250
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: rapid7
NVD analysis: Awaiting Analysis
Record last updated: Jul 24, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Rapid7 InsightVM rapid7:insightvm (from the name)	before 1.1.3935	CNA record
Rapid7 Nexpose rapid7:nexpose (from the name)	before 1.1.3935	CNA record
Rapid7 Insight Agent rapid7:insight_agent (from the name)	before 0.0.245.0	CNA record

References

References

https://docs.rapid7.com/insight/release-notes-2026-july/#vulnerability-management-insightvm	release-notes
https://docs.rapid7.com/insight/release-notes-2026-july/#rapid7-agent-insight-agent	release-notes

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.