CVE-2026-14172

Executive Summary

Business Impact: This vulnerability affects organizations using Rapid7 InsightVM, Nexpose, or the Insight Agent for authenticated vulnerability scanning. A local low-privileged user on a scanned asset can escalate privileges to the level of the scan credential (typically a domain user) or to root/SYSTEM (via the Insight Agent). This poses a critical risk in multi-tenant environments, managed service providers (MSPs), and any organization where scan credentials have elevated network or domain access. The likely attacker is a malicious insider or a threat actor who has already achieved initial low-privileged access to an endpoint.

Vulnerability Class & Attack Vector: This is a local privilege escalation (LPE) vulnerability. The attack vector is local (AV:L), requiring the attacker to have a low-privileged account on the target system. The vulnerability exists because Rapid7's scanning components execute discovered executables during authenticated assessment without validating file ownership. A low-privileged user can place a malicious executable in a location that the scan engine or agent will discover and execute.

Urgency Assessment: The CVSS score is 7.8 (High). The EPSS probability is 0.0%, indicating no observed exploitation in the wild as of the publication date. However, the vulnerability is trivial to exploit once the pre-conditions are met, and the impact (privilege escalation to root/SYSTEM) is severe. Organizations should prioritize patching based on their internal risk assessment, especially in environments where scan credentials have broad privileges.

Key Facts:

• Vendor: Rapid7
• Affected Software: InsightVM, Nexpose, Insight Agent
• Patch Status: Fixed in Scan Engine content 1.1.3935 and Insight Agent content component 0.0.245.0.
• CISA KEV: Not listed.

CVSS Breakdown & Threat Level

Qualitative Severity: High

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Metric Decomposition:

• AV:L (Local): The attacker must have local access to the target system. The vulnerability is not exploitable over the network directly.
• AC:L (Low): No special conditions are required for exploitation beyond placing a malicious executable in a location the scanner will discover. No race condition or complex timing is needed.
• PR:L (Low): The attacker requires a low-privileged user account on the target system. No administrative privileges are needed to exploit the flaw.
• UI:N (None): No user interaction is required. The exploitation occurs automatically when the scan engine or agent runs its assessment.
• S:U (Unchanged): The compromised component (scan engine/agent) and the vulnerable component are the same. The scope of impact is not changed.
• C:H/I:H/A:H (High/High/High): Successful exploitation leads to a complete compromise of confidentiality, integrity, and availability. The attacker can execute arbitrary code with the privileges of the scan credential or root/SYSTEM.

EPSS Interpretation: An EPSS probability of 0.0% means that as of the report date, there is no evidence of active exploitation in the wild. This is typical for a newly published CVE. The probability is expected to increase as technical details become public and PoC code is developed.

Historical Comparison: This vulnerability is similar to CVE-2023-34362 (Progress MOVEit Transfer SQLi) in that it involves a trusted scanning/management tool being used as an attack vector. However, it is more analogous to CVE-2021-44228 (Log4Shell) in the sense that it involves the execution of untrusted input (in this case, executables) without proper validation. The core issue is a failure to validate file ownership before execution, a common flaw in software that performs automated discovery.

Temporal & Environmental Considerations: The CVSS score is based on the base metrics. The temporal score is currently low due to the absence of a public PoC or active exploitation. The environmental score can be higher in environments where scan credentials have domain administrator privileges, as the impact of a successful exploit would be catastrophic.

Technical Deep Dive & Attack Mechanics

Step-by-Step Technical Explanation:

1. Pre-condition: An attacker has a low-privileged user account on a target system that is being scanned by Rapid7 InsightVM, Nexpose, or has the Insight Agent installed.
2. Attack Setup: The attacker places a malicious executable (e.g., evil.exe or malicious.sh) in a location that the Rapid7 scanner will discover during its authenticated assessment. This could be a shared directory, a user's Downloads folder, or a scheduled task directory. The key is that the scanner is configured to discover and execute executables as part of its vulnerability assessment.
3. Trigger: The Rapid7 Scan Engine or Insight Agent runs its authenticated assessment. It discovers the malicious executable and, due to the vulnerability, executes it without checking if the file is owned by a trusted user (e.g., SYSTEM or the scan credential user).
4. Execution: The malicious executable runs with the privileges of the scan credential (if executed by the Scan Engine) or as root/SYSTEM (if executed by the Insight Agent, which runs with elevated privileges).
5. Post-Exploitation: The attacker's code can now perform actions with the elevated privileges, such as installing backdoors, exfiltrating data, or moving laterally to other systems.

Root Cause Analysis: The developer mistake is a failure to validate the ownership of discovered executables before execution. The scanner should only execute files that are owned by a trusted user (e.g., the scan credential user or SYSTEM). By not performing this check, the scanner trusts any executable it finds, regardless of who placed it there.

Attack Surface:

• Local File System: The primary attack surface is the local file system of the scanned asset. Any directory that the scanner is configured to search for executables is a potential vector.
• Shared Network Drives: If the scanner is configured to scan network shares, a low-privileged user on another system could place a malicious executable on the share, which would then be executed by the scanner on the target system.

Pre-conditions:

• The attacker must have a low-privileged account on the target system.
• The Rapid7 scanner must be configured to perform authenticated scans and discover executables.
• The scanner must have the ability to execute discovered executables (this is the default behavior for certain assessment types).

Attack Variants:

• Direct File Drop: The attacker drops a malicious executable in a directory the scanner will check.
• Scheduled Task Abuse: The attacker creates a scheduled task that runs a malicious executable. The scanner may discover and execute the task.
• Service Abuse: The attacker installs a malicious service. The scanner may discover and attempt to interact with it.

Why Standard Defenses May Fail:

• Application Whitelisting: If the scanner is whitelisted to execute files, the malicious executable will run under the scanner's context.
• Anti-Virus: The malicious executable can be custom-built and obfuscated to evade signature-based detection.
• User Account Control (UAC): UAC will not prevent execution because the scanner runs with the privileges of the scan credential, which may already be elevated.

Vulnerable vs. Patched Code Analysis

Vulnerable Code (Pseudocode):

function executeDiscoveredExecutables(scanResults):
    for each executable in scanResults:
        // VULNERABLE: No ownership check
        execute(executable.path)

Patched Code (Pseudocode):

function executeDiscoveredExecutables(scanResults):
    for each executable in scanResults:
        // PATCHED: Validate file ownership
        owner = getFileOwner(executable.path)
        if owner == TRUSTED_USER or owner == SYSTEM:
            execute(executable.path)
        else:
            logWarning("Skipping executable " + executable.path + " owned by " + owner)

Specific Component: The bug resides in the component responsible for executing discovered executables during authenticated assessment. This is likely within the ScanEngine or InsightAgent core module.

Patch Sufficiency: The patch is sufficient as it adds a critical ownership validation check. The fix ensures that only executables owned by a trusted user (the scan credential user or SYSTEM) are executed. This prevents a low-privileged user from placing a malicious executable that the scanner will trust.

Regression Considerations: The patch may cause legitimate executables owned by other users to be skipped. Administrators should review their scan configurations to ensure that all necessary executables are owned by a trusted user. This may require adjusting file permissions on the scanned systems.

Timeline & Disclosure History

• CVE Publication Date: 2026-07-24T05:51:14.326Z
• Estimated Discovery Timeline: Based on the patch release, the vulnerability was likely discovered and reported to Rapid7 several weeks or months prior to the publication date.
• Disclosure Process: The CVE was assigned by a CNA (likely Rapid7 themselves or MITRE). The vendor coordinated the fix and released patches before public disclosure.
• Known Exploitation in the Wild: No known active exploitation as of 2026-07-24.
• CISA KEV Addition Date: Not applicable.

Threat Intelligence Context

Threat Actor Profile: This vulnerability is most likely to be exploited by:

• Insider Threats: A disgruntled employee or contractor with low-privileged access to a system.
• Initial Access Brokers: Threat actors who have already compromised a low-privileged account and are looking to escalate privileges.
• Ransomware Operators: Groups like LockBit or BlackCat, who often use LPE vulnerabilities to gain the privileges needed to deploy ransomware.

Attack Campaign Context: As of the publication date, this CVE is not associated with any known attack campaigns. However, given the widespread use of Rapid7 products, it is likely to be incorporated into the toolkits of various threat actors.

Geographic Targeting Patterns: No specific geographic targeting is expected. The vulnerability affects any organization using the affected Rapid7 products globally.

Industry Verticals Most at Risk:

• Managed Service Providers (MSPs): They often use Rapid7 products to scan their clients' environments. A compromise of the scan credential could lead to a supply chain attack.
• Financial Services: High-value targets with strict compliance requirements.
• Healthcare: Organizations with sensitive patient data.
• Government: Agencies with classified or sensitive information.

Connection to Similar Vulnerability Classes: This vulnerability is a classic example of CWE-250 (Execution with Unnecessary Privileges). It is similar to vulnerabilities in other security tools that run with elevated privileges and fail to validate the source of input or executables.

Exploitation & Lab Setup

Red Team Section

Lab Setup:

1. Environment: A Windows 10/11 or Linux VM (the target) and a separate VM running Rapid7 InsightVM or Nexpose (the scanner).
2. Software Versions:
   • Target: Any OS with a low-privileged user account.
   • Scanner: Rapid7 InsightVM/Nexpose with a vulnerable Scan Engine (pre-1.1.3935) or Insight Agent (pre-0.0.245.0).
3. Network Config: The target must be reachable from the scanner. The scanner must be configured to perform an authenticated scan against the target.

Prerequisites for Exploitation:

• Low-privileged user account on the target (e.g., testuser).
• The scanner must be configured to discover and execute executables.
• The scan credential must have local admin privileges on the target (or the Insight Agent must be installed).

Exploitation Walkthrough:

1. Gain Initial Access: Assume the attacker has a low-privileged shell on the target as testuser.
2. Create Malicious Executable:
   • On Windows: Create C:\Users\testuser\evil.exe that adds testuser to the local Administrators group.
   • On Linux: Create /home/testuser/evil.sh that adds testuser to the sudo group.
3. Wait for Scan: The Rapid7 scanner runs its scheduled authenticated assessment.
4. Trigger: The scanner discovers evil.exe or evil.sh and executes it.
5. Result: testuser is now a local administrator or has root privileges.

Expected Output of Successful Exploitation:

• The attacker's low-privileged user is added to a privileged group.
• The attacker can now execute commands with elevated privileges.

Post-Exploitation:

• Dump LSASS memory for domain credentials.
• Install a persistent backdoor.
• Move laterally to other systems using the compromised scan credential.

Blue Team Section

How to Detect Active Exploitation Attempts:

• Monitor for the creation of unexpected executables in directories that are scanned by Rapid7.
• Alert on the execution of files by the nscscan.exe (Scan Engine) or insight_agent process that are not in a trusted location.

Log Entries That Indicate Exploitation:

• Windows Security Log: Event ID 4688 (Process Creation) showing nscscan.exe or insight_agent.exe spawning a child process like evil.exe.
• Sysmon: Event ID 1 (Process Creation) with a suspicious parent-child relationship.
• Rapid7 Logs: Entries indicating the execution of a discovered executable.

Network Traffic Signatures:

• No specific network signature, as the exploitation is local. However, post-exploitation traffic (e.g., lateral movement) may be observed.

Endpoint Behavioral Indicators:

• A low-privileged user account is unexpectedly added to a privileged group.
• The nscscan.exe or insight_agent process creates child processes that are not typical for the scanner.

Indicators of Compromise (IOCs)

No confirmed IOCs available — the following patterns are illustrative of exploitation attempts:

Network IOCs:

• No specific network IOCs for the initial exploitation. Post-exploitation may involve SMB (port 445) or RDP (port 3389) connections from the compromised host.

HTTP Request Patterns:

• Not applicable for the initial exploitation.

File System Artifacts:

• Unexpected executables in directories like C:\Users\*\Downloads\, C:\Windows\Temp\, or /tmp/.
• Files named to mimic legitimate system tools (e.g., svchost.exe, notmalware.sh).

Process Execution Anomalies:

• Parent Process: nscscan.exe or insight_agent
• Child Process: Any executable not in C:\Program Files\Rapid7\ or /opt/rapid7/.

Log Entries:

• Windows Event ID 4688: Process Created: nscscan.exe (PID: 1234) created evil.exe (PID: 5678)

STIX-like IOC List:

{
  "type": "bundle",
  "id": "bundle--1",
  "objects": [
    {
      "type": "indicator",
      "id": "indicator--1",
      "pattern": "[file:name = 'evil.exe'] AND [process:parent_name = 'nscscan.exe']",
      "description": "Suspicious child process of Rapid7 Scan Engine"
    }
  ]
}

Detection Engineering

YARA Rule

rule CVE-2026-14172_Detection {
    meta:
        description = "Detects exploitation of CVE-2026-14172 in Rapid7"
        author = "Valters IT Hub"
        date = "2026-07-24"
        reference = "https://www.valtersit.com/cve/cve-2026-14172"
    strings:
        $s1 = "nscscan.exe" ascii wide nocase
        $s2 = "insight_agent" ascii wide nocase
        $s3 = "executeDiscoveredExecutables" ascii wide nocase
    condition:
        (uint16(0) == 0x5A4D or uint32(0) == 0x464c457f) and // PE or ELF
        all of ($s1, $s2, $s3)
}

Sigma Rule (SIEM)

title: CVE-2026-14172 Rapid7 Exploitation Detection
id: c080cc44-42e3-491e-9c78-784d4f413b80
status: experimental
description: Detects exploitation attempts targeting CVE-2026-14172 in Rapid7
author: Valters IT Hub
date: 2026-07-24
references:
    - https://www.valtersit.com/cve/cve-2026-14172
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith:
            - '\nscscan.exe'
            - '\insight_agent.exe'
        Image|endswith:
            - '\evil.exe'
            - '\malicious.exe'
    condition: selection
falsepositives:
    - Legitimate executables placed in scan directories by administrators
level: high

Suricata IDS Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (
    msg:"CVE-2026-14172 Rapid7 Post-Exploitation Data Exfiltration";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/exfil"; http_uri;
    sid:1000001;
    rev:1;
)

Elastic (EQL) Query

process where event.type == "start" and
  (process.parent.name : ("nscscan.exe", "insight_agent.exe")) and
  not process.executable : ("C:\\Program Files\\Rapid7\\*", "/opt/rapid7/*")

Splunk SPL Query

index=windows sourcetype=WinEventLog:Security EventCode=4688
| search (ParentProcessName="*\\nscscan.exe" OR ParentProcessName="*\\insight_agent.exe")
| eval suspicious=if(match(ProcessName, "(?i)evil|malicious|backdoor"), 1, 0)
| where suspicious=1
| table _time, ComputerName, User, ParentProcessName, ProcessName

Wazuh Rule

<group name="rapid7_exploitation,">
  <rule id="100001" level="12">
    <if_sid>4688</if_sid>
    <field name="win.eventdata.parentProcessName">nscscan.exe|insight_agent.exe</field>
    <description>CVE-2026-14172: Rapid7 scanner executed a suspicious child process</description>
    <options>no_full_log</options>
    <group>rapid7,exploitation,</group>
  </rule>
</group>

Remediation & Mitigation

Immediate Actions (0-24 hours):

1. Apply Patch: Upgrade the Scan Engine to content version 1.1.3935 and the Insight Agent content component to 0.0.245.0.
   • For Scan Engine: sudo yum update nscscan or download from the Rapid7 support portal.
   • For Insight Agent: The agent should auto-update. If not, force an update via the management console.
2. Compensating Controls (if patch cannot be applied):
   • Restrict the directories that the scanner is allowed to search for executables.
   • Use file system auditing to monitor for the creation of new executables in scan directories.
3. Network-Level Mitigation: Not applicable for this local vulnerability.
4. Authentication/Access Control Hardening:
   • Ensure scan credentials have the minimum necessary privileges.
   • Use dedicated service accounts with limited scope.

Short-term (1-7 days):

1. Configuration Hardening:
   • Review and restrict the scan policy to only discover executables in trusted directories.
   • Disable the "Execute discovered executables" option if it is not required.
2. Monitoring Implementation:
   • Deploy the detection rules provided in this report.
   • Alert on any process creation events where the parent is nscscan.exe or insight_agent.exe.
3. Vulnerability Scanning:
   • Run a scan to confirm the patch has been applied: nscscan --version should return 1.1.3935 or later.

Long-term:

1. Architecture Changes:
   • Implement the principle of least privilege for all scan credentials.
   • Use network segmentation to limit the blast radius of a compromised scan engine.
2. Security Control Improvements:
   • Implement application whitelisting (e.g., AppLocker) to only allow trusted executables to run.
   • Use endpoint detection and response (EDR) solutions to monitor for suspicious process trees.
3. Developer Training:
   • Ensure developers are trained on secure coding practices, specifically around input validation and privilege management.

Validation:

• Check the version of the Scan Engine: nscscan --version
• Check the version of the Insight Agent: insight_agent --version
• Verify that the patch is applied by reviewing the Rapid7 management console for the agent/engine status.

References & Resources

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-14172
• CVE.org: https://www.cve.org/CVERecord?id=CVE-2026-14172
• Vendor advisory: See Rapid7 security page
• OSV: https://osv.dev/vulnerability/CVE-2026-14172 (if applicable)
• Related CWE: https://cwe.mitre.org/data/definitions/250.html
• MITRE ATT&CK: https://attack.mitre.org/techniques/T1059/

Report generated by Valters IT Hub Neural Engine v25 | 2026-07-24 | https://www.valtersit.com/cve/cve-2026-14172