Unvalidated Executable Execution in Rapid7 Assessment Tools

Rapid7 InsightVM, Nexpose, and the Insight Agent execute discovered executables during authenticated assessment without validating file ownership, allowing a local low-privileged user to run code as the scan credential (Scan Engine) or as root/SYSTEM (Insight Agent). Fixed in Scan Engine content 1.1.3935 and Insight Agent content component 0.0.245.0.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-14172 represents a critical privilege escalation vulnerability in Rapid7's InsightVM, Nexpose, and Insight Agent products. During authenticated security assessments, these tools execute discovered executables without verifying file ownership, enabling low-privileged local users to achieve code execution with elevated privileges—either as the Scan Engine credential or as root/SYSTEM depending on the component. This vulnerability affects organizations relying on these widely-deployed vulnerability management platforms, creating a post-assessment exploitation window where attackers with local access can leverage the scanning process itself as a privilege escalation vector. The impact is severe: an attacker can plant malicious executables in predictable locations that the assessment tools will discover and execute with administrative rights, bypassing standard privilege boundaries.

Casky's 224 mapped skills leverage Claude's extended reasoning to identify attack patterns aligned with MITRE ATT&CK technique TA0004 (Privilege Escalation). Practitioners using Casky would detect this vulnerability through skills that analyze executable discovery and execution workflows, specifically flagging instances where file ownership validation is absent before dynamic code execution. The platform's Claude-powered analysis would correlate suspicious patterns: low-privileged process creation of high-privilege child processes, unexpected executable execution during scan operations, and file write operations in scan-monitored directories preceding immediate execution. Practitioners would see findings highlighting the gap between file source verification and execution permissions, the temporal relationship between file placement and assessment scanning, and recommendations to enforce code signing validation and principle-of-least-privilege execution contexts—transforming raw assessment telemetry into actionable privilege escalation intelligence.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-14172.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

penetration testing · medium

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-14172

Casky has 224 skills that investigate the attack patterns behind CVE-2026-14172. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn