CVE-2026-89325

Executive Summary

CVE-2026-89325 is an uncontrolled search path element (CWE-427) vulnerability in Rapid7 InsightVM assessment content deployed through the Insight Agent on Windows. Assessment content at or below version 0.0.261.0 invoked the code command without a fully qualified path from a process running as SYSTEM, allowing a local, low-privileged user to plant an executable named code in a machine-PATH directory they can write to and have it execute with SYSTEM privileges. The issue carries a CVSS 3.1 base score of 7.8 and was remediated in assessment content version 0.0.269.0, which was pushed automatically to all Insight Agents via the Rapid7 Insight Platform.

Technical Analysis

The vulnerability is a classic path interception / uncontrolled search path element (CWE-427) issue. During execution of certain InsightVM assessment content, a check invoked the code command without specifying a fully qualified path. Because the invoking process ran with SYSTEM privileges and the command was resolved dynamically against the machine PATH environment variable at execution time, the resolved binary depended entirely on the ordering and writability of directories in that PATH.

The exploitation precondition is a machine PATH that both:

1. Contains a directory writable by non-administrative users, and
2. Orders that writable directory ahead of the legitimate Visual Studio Code installation (the intended code target).

When both conditions hold, a local low-privileged user can place an executable named code in the writable directory. When the assessment content runs and resolves code, the attacker-supplied binary is launched in the context of the SYSTEM-level process. This is a privilege-escalation condition rooted in unsafe command resolution rather than memory corruption, injection, or authentication bypass.

It is important to distinguish the affected component from the agent software itself. The version range refers to InsightVM assessment content versions, not Insight Agent versions. All Insight Agent versions on Windows were affected while running assessment content at or below 0.0.261.0. Assessment content is delivered centrally through the Rapid7 Insight Platform and is not customer-managed; it updates independently of the installed agent version. This delivery model means exposure and remediation are driven by platform-side content updates rather than by endpoint patch cycles.

Exploitation Scenarios

No public proof-of-concept or exploit code is available; the attack chain below is inferred from the vulnerability class and the NVD description. No specific function names, paths, or parameters beyond code and the machine PATH are asserted, as the description does not provide them.

1. Reconnaissance / target identification: A local, low-privileged user with interactive or code-execution access to a Windows host running the Insight Agent confirms two conditions — that the machine PATH contains a directory writable by non-administrative principals, and that this directory resolves ahead of the legitimate Visual Studio Code installation. This can be determined locally without elevated privileges by inspecting the effective PATH and testing directory write permissions.

2. Triggering the flaw: The attacker plants an executable named code in the writable, PATH-resolving directory. There is no need to modify agent configuration; the malicious file simply occupies the name that the unqualified command invocation will resolve to.

3. Payload execution: The next time the affected assessment content runs — which occurs on the agent's normal schedule and is driven by the Insight Platform — the SYSTEM-level process resolves code against the machine PATH. Because the attacker-controlled directory precedes the legitimate installation, the planted binary is executed instead of the legitimate one, at SYSTEM integrity.

4. Post-exploitation impact: Execution as SYSTEM yields full administrative control of the host. Depending on the payload, the attacker could establish persistence, dump credentials, disable or tamper with security controls, move laterally, or deploy ransomware. The local access requirement and the need for a suitably ordered writable PATH directory constrain exploitation but do not reduce the severity of the resulting privilege (High on Confidentiality, Integrity, and Availability per the CVSS vector).

Impact Assessment

Successful exploitation results in arbitrary code execution with SYSTEM privileges from a low-privileged local starting point. The CVSS 3.1 base score is 7.8 (High), with the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The attack requires local access (AV:L) and low privileges (PR:L), needs no user interaction (UI:N), and has low attack complexity (AC:L). Impact to confidentiality, integrity, and availability is High across the board; scope is unchanged (S:U), meaning the compromised component is the security authority whose privileges are gained.

Blast radius considerations: the affected code path resides in assessment content delivered to all Insight Agents via the Rapid7 Insight Platform, so any Windows endpoint running the affected content version with a suitable PATH configuration is potentially exposed. Enterprise environments routinely include endpoints where user-writable directories appear earlier in PATH than expected, and the requirement for a non-administrative user with local execution capability is common in shared or multi-user systems — precisely the targets most damaging to compromise. The EPSS score has not yet been published by FIRST.org; no value is asserted here. The CVE is not listed in CISA KEV, and no exploit code or Nuclei template is known.

Detection Guidance

Sigma Rule

title: Suspicious Execution of Unqualified 'code' Command by Insight Agent
id: 9f2b7c14-3a6d-4e8b-9c05-71d0e4b3a512
status: experimental
description: Detects the Rapid7 Insight Agent (SYSTEM context) spawning a 'code' executable from an unexpected or user-writable path, consistent with CVE-2026-89325 PATH interception.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-89325
author: Threat Intelligence
date: 2026-09-15
logsource:
  product: windows
  category: process_creation
detection:
  selection_parent:
    ParentImage|endswith:
      - '\rapid7\insight_agent\agent_ctl.exe'
      - '\insight_agent\endpoint_agent.exe'
  selection_image:
    Image|endswith: '\code.exe'
  filter_legit:
    Image|contains:
      - '\Microsoft VS Code\'
      - '\Program Files\'
  condition: selection_parent and selection_image and not filter_legit
falsepositives:
  - Legitimate VS Code invoked from a non-standard but admin-controlled installation path
level: high

YARA Rule

rule CVE_2026_89325_PATH_HIJACK_CODE_BINARY
{
    meta:
        author = "Threat Intelligence"
        description = "Detects executables named 'code' planted in user-writable directories for CVE-2026-89325 PATH interception"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-89325"
        date = "2026-09-15"
        severity = "high"

    strings:
        $mz = { 4D 5A }
        $pe = { 50 45 00 00 }
        $s1 = "code" ascii wide nocase
        $s2 = "cmd.exe" ascii wide nocase
        $s3 = "powershell" ascii wide nocase

    condition:
        $mz at 0 and $pe and (
            (uint16(0x3C) > 0 and filesize < 5MB) and
            (any of ($s2, $s3))
        )
}

Suricata IDS Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-89325 Rapid7 Insight Agent InsightVM Assessment Content Retrieval (Possible PATH Hijack Stage)"; flow:established,to_server; http.method; content:"GET"; http.header; content:"Insight"; http.uri; content:"assessment"; nocase; reference:cve,2026-89325; classtype:attempted-user; sid:202689325; rev:1;)

Elastic Detection

process where event.type == "start" and
  process.parent.name in ("agent_ctl.exe", "endpoint_agent.exe", "ir_agent.exe") and
  process.name : "code.exe" and
  not process.executable : ("*\\Microsoft VS Code\\*", "*\\Program Files\\*", "*\\Program Files (x86)\\*")

Splunk SPL Query

index=windows sourcetype=WinEventLog:Security EventCode=4688
| where match(Parent_Process_Name, "(?i)(agent_ctl|endpoint_agent|ir_agent)\\\\endpoint_agent\.exe$")
| where match(New_Process_Name, "(?i)\\\\code(\.exe)?$")
| where NOT match(New_Process_Name, "(?i)(Microsoft VS Code|Program Files)")
| table _time, host, Account_Name, Parent_Process_Name, New_Process_Name, New_Process_Id
| sort - _time

Wazuh OSSEC Rule

<group name="windows,cve-2026-89325,">
  <rule id="202689325" level="12">
    <if_sid>60000</if_sid>
    <field name="win.eventdata.parentImage">(?i)(agent_ctl|endpoint_agent|ir_agent)\.exe$</field>
    <field name="win.eventdata.image">(?i)\\code(\.exe)?$</field>
    <field name="win.eventdata.image" negate="yes">(?i)(Microsoft VS Code|Program Files)</field>
    <description>CVE-2026-89325: Suspicious unqualified 'code' execution by Insight Agent (possible PATH interception privesc)</description>
    <mitre>
      <id>T1574.007</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Confirm that InsightVM assessment content has been updated to version 0.0.269.0 or later. Because content is delivered automatically via the Rapid7 Insight Platform and is not customer-managed, verify the effective content version on the platform side rather than relying on endpoint agent versions.
   • Audit the machine PATH on Windows hosts for directories that are writable by non-administrative users, and remove or reorder any such entries that precede trusted installation directories. Ensure user-writable directories are never resolved ahead of legitimate tool installations.
   • Restrict local interactive and code-execution access on hosts running the Insight Agent, and monitor for the creation of files named code outside legitimate Visual Studio Code installation directories.

2. Patch / upgrade steps:

   • No patch is available from tracked sources at this time. Remediation is delivered out-of-band via assessment content version 0.0.269.0 (generally available September 15, 2026). Confirm with Rapid7 or via the Insight Platform that this content version is active. The vendor reports that remediation deployed automatically and no customer action is required; independently validate this in your environment.

3. Long-term hardening:

   • Enforce the principle of least privilege so that non-administrative users cannot write to any directory that appears in a SYSTEM process's PATH.
   • Standardize on fully qualified binary paths and explicit directory allow-listing for security tooling that executes with elevated privileges.
   • Maintain visibility into centrally delivered, non-customer-managed content (such as assessment/agent content) as part of change management, and monitor for privileged processes resolving executables from writable paths.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-89325
• CWE-427: Uncontrolled Search Path Element — https://cwe.mitre.org/data/definitions/427.html
• MITRE ATT&CK T1574.007: Hijack Execution Flow — Path Interception by PATH Environment Variable — https://attack.mitre.org/techniques/T1574/007/
• Rapid7 Insight Platform / InsightVM assessment content release notes and advisories — https://www.rapid7.com/products/insightvm/
• FIRST EPSS: not yet scored for this CVE (no value available at time of writing)

No known threat actor campaigns, public exploit code, or exploit-in-the-wild evidence are available for CVE-2026-89325. The CVE is not listed in CISA KEV.