CVE-2026-7373: 
Rapid7 Metasploit vulnerability analysis and mitigation

CVE-2026-7373 is a local privilege escalation (LPE) vulnerability in Rapid7 Metasploit Pro on Windows that allows a low-privileged local user to achieve SYSTEM-level code execution. The vulnerability arises because the metasploitPostgreSQL service's child process postgres.exe attempts to load an OpenSSL configuration file (openssl.cnf) from a static, user-writable directory. By planting a crafted openssl.cnf file in that directory, an attacker can cause the high-privilege service to execute arbitrary commands. The vulnerability was disclosed on May 15, 2026, and patched in Metasploit Pro version 5.0.0-2026051301 (released May 13, 2026). It carries a CVSS v4.0 base score of 8.5 (High) (GitHub Advisory, Rapid7 Release Notes).

The root cause is an uncontrolled search path element (CWE-427) combined with improper access control (CWE-284) and inclusion of functionality from an untrusted control sphere (CWE-829). When the metasploitPostgreSQL Windows service starts, it spawns postgres.exe, which attempts to load an OpenSSL configuration file (openssl.cnf) from a hardcoded static directory path that is writable by standard (non-administrative) users. An attacker with local access can place a maliciously crafted openssl.cnf in this directory; the OpenSSL library's engine-loading or configuration directives within the file can be abused to execute arbitrary code in the context of the SYSTEM-privileged service. No user interaction or elevated privileges are required for exploitation — only local access to the host. The vulnerability was discovered and reported by Andrea Intilangelo (Rapid7 Release Notes, GitHub Advisory).

Successful exploitation grants the attacker full SYSTEM-level control of the affected Windows host, representing a complete compromise of confidentiality, integrity, and availability. An attacker can read all data on the system, modify or destroy files, install persistent backdoors, disable security tools, and use the compromised host as a pivot point for lateral movement within the network. Because Metasploit Pro is a penetration testing platform that typically stores sensitive engagement data, credentials, and session information, exploitation could also expose highly sensitive security assessment artifacts (GitHub Advisory, Rapid7 Release Notes).

The CVSS v4.0 exploit maturity is rated Proof of Concept (E:P), indicating that PoC-level exploit code or techniques are known, though no public weaponized exploit has been confirmed. There is no evidence of active in-the-wild exploitation at this time, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.014% (0th percentile), reflecting a low near-term exploitation probability. No specific threat actor attribution has been reported (GitHub Advisory, Feedly).

1. Reconnaissance: Identify a Windows host running Rapid7 Metasploit Pro with the metasploitPostgreSQL service active. Confirm local user access (e.g., as the vagrant user or any standard local user with write access to the affected directory).
2. Locate the writable OpenSSL config path: Identify the static directory from which postgres.exe attempts to load openssl.cnf at service startup. This directory is writable by standard users and may not exist by default (non-existent directory that is user-writable once created).
3. Craft a malicious openssl.cnf: Create a crafted OpenSSL configuration file that leverages OpenSSL's engine or provider loading directives to execute arbitrary code. For example, reference a malicious shared library (DLL) via an [openssl_init] or [engines] section that loads attacker-controlled code.
4. Plant the file: Write the crafted openssl.cnf to the target directory before or during service startup.
5. Trigger service startup: Wait for or trigger a restart of the metasploitPostgreSQL service (e.g., system reboot, service restart). The service spawns postgres.exe, which loads the malicious openssl.cnf.
6. Achieve SYSTEM execution: The attacker-controlled code specified in the openssl.cnf executes in the context of the SYSTEM-privileged service, granting full host compromise (GitHub Advisory, Rapid7 Release Notes).

• File System: Presence of an unexpected or newly created openssl.cnf file in the static directory loaded by the metasploitPostgreSQL/postgres.exe service; unusual DLLs or executables in directories referenced by that configuration file.
• Process: Unexpected child processes spawned by postgres.exe or the metasploitPostgreSQL service (e.g., cmd.exe, powershell.exe, net.exe, reverse shell binaries); processes running as SYSTEM with unusual parent-child relationships involving postgres.exe.
• Logs: Windows Event Log entries (Event ID 7036 or 7045) showing unexpected service state changes for metasploitPostgreSQL; audit logs recording file creation events in the affected OpenSSL config directory by non-administrative users.
• Network: Unexpected outbound network connections from the postgres.exe process or SYSTEM-level processes to external IP addresses, particularly shortly after service startup.

Rapid7 has released a fix in Metasploit Pro version 5.0.0-2026051301 (released May 13, 2026), which adds proper OpenSSL configuration for the PostgreSQL service and restricts the configuration file loading path. Users should update to this version or later immediately (Rapid7 Release Notes). As interim workarounds until patching is complete: restrict local user access to Metasploit Pro installation hosts; audit and tighten file system permissions on directories where the PostgreSQL service loads configuration files to prevent standard users from writing to them; and monitor for suspicious openssl.cnf file creation in service-related paths. Note that the original advisory also mentioned the vagrant user as a specific risk factor — administrators should audit whether this account exists on Metasploit Pro hosts and remove or restrict it if not required (GitHub Advisory).

Rapid7 credited security researcher Andrea Intilangelo for discovering and responsibly disclosing the vulnerability, acknowledging the report in the official release notes for version 5.0.0-2026051301 (Rapid7 Release Notes). The GitHub Advisory Database published the advisory on May 15, 2026, and it was last updated May 18, 2026. No significant broader media coverage or notable social media discussion has been identified beyond standard vulnerability database aggregation.