Local Code Execution Vulnerability in Rapid7 InsightVM and Insight Agent
CVE-2026-14172

7.8HIGH

Key Information:

Vendor

Rapid7

Status
Insightvm
Nexpose
Insight Agent
Vendor
CVE Published:
24 July 2026

What is CVE-2026-14172?

A vulnerability in Rapid7's InsightVM and Insight Agent architecture allows local low-privileged users to execute arbitrary code. This occurs due to the software’s failure to validate file ownership when executing discovered executables during authenticated assessments. As a result, users can exploit this flaw to run code with the privileges of the scan credentials or impersonate the system. The risk is mitigated in recent releases with updated content, ensuring that users upgrade to the patched versions to enhance their security posture.

Affected Version(s)

Insight Agent Windows 0 < 0.0.245.0

InsightVM Windows 0 < 1.1.3935

Nexpose Windows 0 < 1.1.3935

References

https://docs.rapid7.com/insight/release-notes-2026-july/#...
release-notes
https://docs.rapid7.com/insight/release-notes-2026-july/#...
release-notes

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Paul Miseiko of Rapid7
Patrick Fitzsimons of Rapid7
.