CVE-2026-14172

7.8 Élevée

Publiée le 24/07/2026 à 09:16 · Modifiée le 30/07/2026 à 16:15 · En attente d'analyse NVD · Source : cve@rapid7.com

Description

Rapid7 InsightVM, Nexpose, and the Insight Agent execute discovered executables during authenticated assessment without validating file ownership, allowing a local low-privileged user to run code as the scan credential (Scan Engine) or as root/SYSTEM (Insight Agent). Fixed in Scan Engine content 1.1.3935 and Insight Agent content component 0.0.245.0.

Traduire en français

Produits concernés

Rapid7 InsightVM
Rapid7 Nexpose
Rapid7 Insight Agent

Scores CVSS

Version	Score	Source	Vecteur
3.1	7.8 Élevée	cve@rapid7.com	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-250

Références

https://docs.rapid7.com/insight/release-notes-2026-july/#rapid7-agent-insight-agent
https://docs.rapid7.com/insight/release-notes-2026-july/#vulnerability-management-insightvm

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories