CVE-2026-14172: rapid7 insight_agent Execution with Unnecessary Privileges

Vulnerability summary

CVE-2026-14172 is a high (CVSS 7.8) Execution with Unnecessary Privileges vulnerability in rapid7 insight_agent. EPSS estimates a 0.16% chance of exploitation in the next 30 days, higher than 4.4% of scored vulnerabilities.

Timeline

1. 24-07-2026
   PublishedVulnerability first disclosed.
2. 25-07-2026
   Last modifiedVulnerability information updated.

Description

Rapid7 InsightVM, Nexpose, and the Insight Agent execute discovered executables during authenticated assessment without validating file ownership, allowing a local low-privileged user to run code as the scan credential (Scan Engine) or as root/SYSTEM (Insight Agent). Fixed in Scan Engine content 1.1.3935 and Insight Agent content component 0.0.245.0.

• CWE-250Execution with Unnecessary PrivilegesThe product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.