Local Privilege Escalation Vulnerability in Rapid7 Metasploit Pro

CVE-2026-7373

What is CVE-2026-7373?

A local privilege escalation vulnerability exists in Rapid7 Metasploit Pro that allows unprivileged users to execute arbitrary commands with SYSTEM level access on Windows hosts. This issue arises due to the metasploitPostgreSQL service attempting to load an OpenSSL configuration file from a non-existent, user-writable directory. By placing a malicious openssl.cnf file in that directory, attackers can manipulate the high-privilege service to execute their commands, leading to potential full host compromises.

References