CVE-2026-6482: 
Rapid7 Insight Cloud Agent vulnerability analysis and mitigation

CVE-2026-6482 is a local privilege escalation (LPE) vulnerability in the Rapid7 Insight Agent for Windows that allows unprivileged local users to gain SYSTEM-level control of the host. The vulnerability affects all Insight Agent versions prior to 4.1.0.2. It was disclosed on April 17, 2026, with the CVE assigned by Rapid7, Inc. The CVSS v4.0 base score is 8.5 (High), and the CVSS v3.1 base score is 7.8 (High) (GitHub Advisory, Rapid7 Release Notes).

The root cause is classified as CWE-829 (Inclusion of Functionality from Untrusted Control Sphere). Upon startup, the Rapid7 Insight Agent service — which runs with SYSTEM-level privileges — attempts to load an OpenSSL configuration file (openssl.cnf) from a directory that does not exist but is writable by standard (unprivileged) users. An attacker can plant a crafted openssl.cnf file in this world-writable directory, causing the high-privilege service to load and execute arbitrary commands specified within it when the service next starts. The attack requires local access to the machine and is triggered by a service restart or system reboot (GitHub Advisory, Rapid7 Release Notes).

Successful exploitation allows an unprivileged local user to escalate privileges to SYSTEM level, achieving full host compromise on the affected Windows machine. This grants the attacker complete control over the operating system, including the ability to read sensitive credentials and data, modify or destroy system files, install persistent backdoors, disable security controls, and potentially use the compromised host as a pivot point for lateral movement within the network. Both confidentiality and integrity are fully compromised, with partial availability impact (GitHub Advisory).

The CVSS v4.0 exploit maturity is rated as Proof-of-Concept (E:P), indicating that PoC-level exploit code or techniques are publicly known, though no weaponized exploit kit or confirmed in-the-wild exploitation has been reported as of the time of disclosure (GitHub Advisory). The EPSS score is approximately 0.014% (0th percentile), reflecting a low near-term exploitation probability. There is no evidence of threat actor attribution or inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog at this time. Exploitation requires local access to the target Windows host.

1. Reconnaissance: Identify Windows hosts running Rapid7 Insight Agent versions prior to 4.1.0.2. This can be done by querying installed software via wmic product get name,version or checking the agent installation directory.
2. Identify the vulnerable directory: Determine the non-existent but user-writable directory from which the Insight Agent service attempts to load openssl.cnf at startup. This can be discovered by monitoring file system access using tools like Process Monitor (Procmon) during a service restart, filtering for NAME NOT FOUND results related to openssl.cnf.
3. Create the target directory: As a standard (unprivileged) user, create the missing directory identified in the previous step, since it is writable by standard users.
4. Plant the malicious configuration file: Place a crafted openssl.cnf file in the newly created directory. The file should contain OpenSSL engine or CONF module directives that cause the loading of a malicious DLL or execution of arbitrary commands when parsed by the OpenSSL library.
5. Trigger service restart: Wait for or trigger a restart of the Rapid7 Insight Agent service (e.g., via system reboot or if the attacker has rights to restart services). The service, running as SYSTEM, loads the crafted openssl.cnf and executes the attacker-specified payload with SYSTEM privileges.
6. Achieve SYSTEM-level access: The payload executes under the SYSTEM context, granting the attacker full control of the Windows host (GitHub Advisory).

• File System: Presence of an unexpected openssl.cnf file in a directory under the Rapid7 Insight Agent installation path or a related user-writable directory; newly created directories in the agent's working path that were not present during installation.
• Process: Unusual child processes spawned by the Rapid7 Insight Agent service process (e.g., cmd.exe, powershell.exe, rundll32.exe) with SYSTEM-level privileges; unexpected DLL loads by the agent process from non-standard directories.
• Logs: Windows Event Log entries (Event ID 7045 or 7036) showing unexpected service state changes for the Rapid7 Insight Agent; Security event logs showing privilege use or process creation under the SYSTEM account initiated by the agent service.
• Network: Outbound connections from the Insight Agent process to unexpected external IP addresses or domains following a service restart.

Rapid7 has released version 4.1.0.2 of the Insight Agent, which addresses this vulnerability. All users should upgrade to version 4.1.0.2 or later immediately (Rapid7 Release Notes). As a temporary workaround prior to patching, administrators should restrict write permissions on the directories from which the Insight Agent service loads OpenSSL configuration files, preventing standard users from creating or modifying files in those paths. Additionally, monitoring for unexpected files (particularly openssl.cnf) in agent-related directories can help detect exploitation attempts.

The vulnerability was disclosed by Rapid7 itself as the CNA, reflecting responsible self-disclosure practices. A technical write-up was published by infinitsec.net shortly after disclosure, providing additional analysis of the LPE mechanism (infinitsec.net). General community tracking was observed across vulnerability aggregators and social platforms, but no significant controversy or widespread media coverage has been noted given the local-only attack vector.