CVE Intelligence

Rapid7 Nexpose vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Rapid7 Nexpose: 1 record(s), with affected versions and fixes.

CVE-2026-14172 High · 7.8 CWE-250 Jul 24, 2026
Rapid7 InsightVM, Nexpose, and Insight Agent Local Privilege Escalation via Unvalidated Executable Invocation
Rapid7 InsightVM, Nexpose, and the Insight Agent execute discovered executables during authenticated assessment without validating file ownership, allowing a local low-privileged user to run code as the scan credential (Scan Engine) or as root/SYSTEM (Insight Agent). Fixed in Scan Engine content 1.1.3935 and Insight Agent content component 0.0.245.0.