CVE-2026-89325

An uncontrolled search path element in InsightVM assessment content in Rapid7 Insight Agent on Windows allows a local, low-privileged user to execute arbitrary code as SYSTEM via a planted executable resolved from the machine PATH. Assessment content at or below version 0.0.261.0 included a check that invoked the `code` command without a fully qualified path from a process running as SYSTEM. The command was resolved against the machine PATH environment variable at execution time. Where the machine PATH contained a directory writable by non-administrative users and ordered ahead of the legitimate Visual Studio Code installation, a local user could place an executable named `code` in that directory and cause the agent to execute it with SYSTEM privileges. The version range above refers to InsightVM assessment content versions, not Insight Agent versions. All Insight Agent versions were affected while running assessment content at or below 0.0.261.0. Assessment content is delivered to all Insight Agents via the Rapid7 Insight Platform independently of the Insight Agent version and is not customer-managed. This issue was resolved in assessment content version 0.0.269.0, which was made generally available on September 15, 2026. Remediation was deployed automatically and no customer action is required.

• CWE-427

• https://docs.rapid7.com/insight/release-notes-2026-september/#resolved-cve-2026-89325

Published

Sep 24, 2026

Last Modified

Sep 26, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-89298A flaw was found in the Dynamic Client Registration service …4.9
• CVE-2026-89307The "Firma Circolare" feature in the "Design Scuole Italia" …5.1
• CVE-2026-89308An unauthenticated OS command injection vulnerability exists…9.3
• CVE-2026-8931A critical Remote Code Execution (RCE) vulnerability exists …9.4
• CVE-2026-8932libcurl would reuse a previously created connection even whe…7.5
• CVE-2026-89321Publishing limits the compressed size of a VSIX (ovsx.publis…4.3
• CVE-2026-89327The FluentBoards WordPress plugin before 2.0.15 does not ve…3.8
• CVE-2026-89328The FluentBoards WordPress plugin before 2.0.15 does not pr…3.8
• CVE-2026-89329A flaw was found in `multipathd`. A local attacker with acce…6.2
• CVE-2026-8933A local privilege escalation vulnerability exists in snap-co…7.8
• CVE-2026-89330The EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Revie…6.1
• CVE-2026-89331The FluentBoards WordPress plugin before 2.1.0 does not pro…5.3