Acunetix 25.11.251107123 for Windows contains a local privilege escalation vulnerability in the Web Vulnerability Scanning Engine (wvsc.exe) that allows low-privileged local attackers to execute arbitrary code as SYSTEM by exploiting a missing hardcoded directory path for OpenSSL-related files. Attackers can create the missing directory, place a malicious file at the expected path, and cause the SYSTEM-level wvsc.exe process to load and execute it, resulting in full privilege escalation.

Affected: Invicti Acunetix

Acunetix 25.11.x - Local Privilege Escalation Vulnerability via OpenSSL Configuration (CVE-2026-6958)

- Software Link:

https://www.acunetix.com

- Affected Versions:

Version 25.11.x (tested on Microsoft Windows 11 and 11 IoT Enterprise LTSC) Other versions may be affected as well.

- Vulnerability Description:

A local privilege escalation vulnerability has been identified in Acunetix (Web Vulnerability Scanner, or abbreviated AWVS) 25.11.x The vulnerability is caused by the use of a hardcoded OpenSSL-related directory path that does not exist by default and is writable by low-privileged users. The affected binary, wvsc.exe, runs with SYSTEM privileges and attempts to load OpenSSL-related files from an hardcoded location:

C:\builds\[PATH OMITTED]\[REDACTED]\openssl.cnf

Since this directory does not exist by default, a low-privileged local user can create the missing directory hierarchy and place files in a location that is subsequently accessed by the SYSTEM-level process. As a result, files placed in the attacker-controlled directory may be loaded or otherwise processed by wvsc.exe with SYSTEM privileges, potentially allowing a local unprivileged attacker to escalate privileges to SYSTEM.

The issue is therefore an insecure OpenSSL directory/search path combined with an unsafe filesystem permission model.

- Proof of Concept:

The PoC in the original advisory demonstrates that a low-privileged local user can create the otherwise missing directory and cause the SY…

Acunetix 25.11.251107123 for Windows contains a local privilege escalation vulnerability in the Web Vulnerability Scanning Engine (wvsc.exe) that allows low-privileged local attackers to execute arbitrary code as SYSTEM by exploiting a missing hardcoded directory path for OpenSSL-related files. Attackers can create the missing directory, place a malicious file at the expected path, and cause the SYSTEM-level wvsc.exe process to load and execute it, resulting in full privilege escalation.