CVE-2019-5629

Rapid7 Insight Agent, version 2.6.3 and prior, suffers from a local privilege escalation due to an uncontrolled DLL search path. Specifically, when Insight Agent 2.6.3 and prior starts, the Python interpreter attempts to load python3.dll at "C:\DLLs\python3.dll," which normally is writable by locally authenticated users. Because of this, a malicious local user could use Insight Agent's startup conditions to elevate to SYSTEM privileges. This issue was fixed in Rapid7 Insight Agent 2.6.4.

• CWE-427
• CWE-427

• http://packetstormsecurity.com/files/153159/Rapid7-Windows-InsightIDR-Agent-2.6.3.14-Local-Privilege-Escalation.htmlThird Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2019/Jun/13Mailing List, Third Party Advisory
• https://bogner.sh/2019/06/local-privilege-escalation-in-rapid7s-windows-insight-idr-agent/Exploit, Third Party Advisory
• https://help.rapid7.com/insightagent/release-notes/archive/2019/05/#20190529Third Party Advisory
• https://seclists.org/bugtraq/2019/Jun/0Issue Tracking, Mailing List, Third Party Advisory
• http://packetstormsecurity.com/files/153159/Rapid7-Windows-InsightIDR-Agent-2.6.3.14-Local-Privilege-Escalation.htmlThird Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2019/Jun/13Mailing List, Third Party Advisory
• https://bogner.sh/2019/06/local-privilege-escalation-in-rapid7s-windows-insight-idr-agent/Exploit, Third Party Advisory
• https://help.rapid7.com/insightagent/release-notes/archive/2019/05/#20190529Third Party Advisory
• https://seclists.org/bugtraq/2019/Jun/0Issue Tracking, Mailing List, Third Party Advisory

Published

Jul 13, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-5622Accellion File Transfer Appliance version FTA_8_0_540 suffer…9.8
• CVE-2019-5623Accellion File Transfer Appliance version FTA_8_0_540 suffer…9.8
• CVE-2019-5624Rapid7 Metasploit Framework suffers from an instance of CWE-…7.3
• CVE-2019-5625The Android mobile application Halo Home before 1.11.0 store…7.1
• CVE-2019-5626The Android mobile application BlueCats Reveal before 3.0.19…7.8
• CVE-2019-5627The iOS mobile application BlueCats Reveal before 5.14 store…7.8
• CVE-2019-5630A Cross-Site Request Forgery (CSRF) vulnerability was found …5.9
• CVE-2019-5631The Rapid7 InsightAppSec broker suffers from a DLL injection…7.8
• CVE-2019-5632An insecure storage of sensitive information vulnerability i…5.5
• CVE-2019-5633An insecure storage of sensitive information vulnerability i…5.5
• CVE-2019-5634An inclusion of sensitive information in log files vulnerabi…6.5
• CVE-2019-5635A cleartext transmission of sensitive information vulnerabil…7.5