Rapid7 Metasploit Pro is vulnerable to a local privilege escalation that allows an unprivileged Windows user to gain SYSTEM level control. The vulnerability stems from the metasploitPostgreSQL service loading an OpenSSL configuration file from a directory that is writable by standard users. By planting a crafted openssl.cnf file, the attacker tricks the high‑privilege service into executing arbitrary commands, effectively bypassing security controls and achieving full host compromise.

All versions of Rapid7 Metasploit Pro deployed on Windows hosts that have not been updated to the latest release are affected. The flaw involves the metasploitPostgreSQL service bundled with Metasploit Pro and does not extend beyond the supported operating systems specified in Rapid7’s documentation.

The CVSS base score of 8.5 indicates a high severity with local execution and privilege escalation. EPSS is not available so exploitation probability is unclear, the vulnerability requires only local user write access to a specific directory. Since the flaw is not listed in the CISA KEV catalog, there is no known widespread exploitation, yet the local nature of the attack enables an attacker with basic file write permissions to pivot to SYSTEM level. The attack vector is inferred to be local, requiring authenticated or local access.