Description
An uncontrolled search path element in InsightVM assessment content in Rapid7 Insight Agent on Windows allows a local, low-privileged user to execute arbitrary code as SYSTEM via a planted executable resolved from the machine PATH.

Assessment content at or below version 0.0.261.0 included a check that invoked the `code` command without a fully qualified path from a process running as SYSTEM. The command was resolved against the machine PATH environment variable at execution time. Where the machine PATH contained a directory writable by non-administrative users and ordered ahead of the legitimate Visual Studio Code installation, a local user could place an executable named `code` in that directory and cause the agent to execute it with SYSTEM privileges.

The version range above refers to InsightVM assessment content versions, not Insight Agent versions. All Insight Agent versions were affected while running assessment content at or below 0.0.261.0. Assessment content is delivered to all Insight Agents via the Rapid7 Insight Platform independently of the Insight Agent version and is not customer-managed.

This issue was resolved in assessment content version 0.0.269.0, which was made generally available on September 15, 2026. Remediation was deployed automatically and no customer action is required.
Published: 2026-09-24
Score: 7.8 High
EPSS: n/a
KEV: No
Impact: Local Privilege Escalation
Action: No action required
AI Analysis

Impact

An uncontrolled search path element in Rapid7 Insight Agent allows a local, low‑privileged user to execute arbitrary code with SYSTEM privileges by planting an executable named "code" in a writable directory that appears early in the machine PATH. This flaw, classified as CWE-427, permits a local user to bypass privilege boundaries and run any code as the highest system account on the host.

Affected Systems

Rapid7 Insight Agent running on Windows is affected. All agent versions are impacted as long as they process assessment content versions 0.0.261.0 or earlier, which are shipped through the Rapid7 Insight Platform regardless of the agent build. The vulnerability is tied to the assessment content rather than the agent code itself.

Risk and Exploitability

The CVSS score of 7.8 indicates a high severity vulnerability. EPSS data is not available, and the issue is not listed in the CISA KEV catalog. The likely attack vector is local: a user with write access to a PATH directory preceding the legitimate Visual Studio Code installation can place a malicious executable. Once the agent runs the process as SYSTEM, the attacker achieves full control over the machine. Remote exploitation is not possible; the flaw requires local presence and the ability to write to the specified directory.

Generated by OpenCVE AI on September 25, 2026 at 04:55 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Set the Windows PATH environment variable so that no directories writable by non‑administrative users appear before the legitimate Visual Studio Code installation, and restrict write permissions on any such directories.
  • Implement application whitelisting or control policies that restrict execution of unknown or untrusted binaries from user‑writable locations, thereby preventing execution of injected "code" executables at SYSTEM level.
  • Continuously monitor Insight Agent logs and Windows event logs for unexpected execution of processes named "code" or other anomalous SYSTEM‑level activity to detect potential exploitation attempts.

Generated by OpenCVE AI on September 25, 2026 at 04:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 24 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 24 Sep 2026 19:15:00 +0000

Type Values Removed Values Added
Description An uncontrolled search path element in InsightVM assessment content in Rapid7 Insight Agent on Windows allows a local, low-privileged user to execute arbitrary code as SYSTEM via a planted executable resolved from the machine PATH. Assessment content at or below version 0.0.261.0 included a check that invoked the `code` command without a fully qualified path from a process running as SYSTEM. The command was resolved against the machine PATH environment variable at execution time. Where the machine PATH contained a directory writable by non-administrative users and ordered ahead of the legitimate Visual Studio Code installation, a local user could place an executable named `code` in that directory and cause the agent to execute it with SYSTEM privileges. The version range above refers to InsightVM assessment content versions, not Insight Agent versions. All Insight Agent versions were affected while running assessment content at or below 0.0.261.0. Assessment content is delivered to all Insight Agents via the Rapid7 Insight Platform independently of the Insight Agent version and is not customer-managed. This issue was resolved in assessment content version 0.0.269.0, which was made generally available on September 15, 2026. Remediation was deployed automatically and no customer action is required.
Title Rapid7 Insight Agent: Uncontrolled search path element in InsightVM assessment content leads to local privilege escalation
First Time appeared Rapid7
Rapid7 insight Agent
Weaknesses CWE-427
CPEs cpe:2.3:a:rapid7:insight_agent:*:*:windows:*:*:*:*:*
Vendors & Products Rapid7
Rapid7 insight Agent
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Rapid7 Insight Agent
cve-icon MITRE

Status: PUBLISHED

Assigner: rapid7

Published:

Updated: 2026-09-24T19:14:02.397Z

Reserved: 2026-09-11T14:26:28.618Z

Link: CVE-2026-89325

cve-icon Vulnrichment

Updated: 2026-09-24T19:10:34.525Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-24T19:17:19.580

Modified: 2026-09-24T21:00:46.893

Link: CVE-2026-89325

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-25T07:45:18Z

Weaknesses
  • CWE-427

    Uncontrolled Search Path Element