https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 14:42:41 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-6958 <p>Acunetix 25.11.251107123 for Windows contains a local privilege escalation vulnerability in the Web Vulnerability Scanning Engine (wvsc.exe) that allows low-privileged local attackers to execute arbitrary code as SYSTEM by exploiting a missing hardcoded directory path for OpenSSL-related files. Attackers can create the missing directory, place a malicious file at the expected path, and cause the SYSTEM-level wvsc.exe process to load and execute it, resulting in full privilege escalation.</p> <p>Acunetix 25.11.251107123 for Windows contains a local privilege escalation vulnerability in the Web Vulnerability Scanning Engine (wvsc.exe) that allows low-privileged local attackers to execute arbitrary code as SYSTEM by exploiting a missing hardcoded directory path for OpenSSL-related files. Attackers can create the missing directory, place a malicious file at the expected path, and cause the SYSTEM-level wvsc.exe process to load and execute it, resulting in full privilege escalation.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-6958 https://vulnerability.circl.lu/vuln/gcve-1988-2026-0172 <p><strong>Affected:</strong> Invicti Acunetix</p> <p>Acunetix 25.11.x - Local Privilege Escalation Vulnerability via OpenSSL Configuration (CVE-2026-6958)</p> <p>- Software Link:</p> <p>https://www.acunetix.com</p> <p>- Affected Versions:</p> <p>Version 25.11.x (tested on Microsoft Windows 11 and 11 IoT Enterprise LTSC) Other versions may be affected as well.</p> <p>- Vulnerability Description:</p> <p>A local privilege escalation vulnerability has been identified in Acunetix (Web Vulnerability Scanner, or abbreviated AWVS) 25.11.x The vulnerability is caused by the use of a hardcoded OpenSSL-related directory path that does not exist by default and is writable by low-privileged users. The affected binary, wvsc.exe, runs with SYSTEM privileges and attempts to load OpenSSL-related files from an hardcoded location:</p> <p>C:\builds\[PATH OMITTED]\[REDACTED]\openssl.cnf</p> <p>Since this directory does not exist by default, a low-privileged local user can create the missing directory hierarchy and place files in a location that is subsequently accessed by the SYSTEM-level process. As a result, files placed in the attacker-controlled directory may be loaded or otherwise processed by wvsc.exe with SYSTEM privileges, potentially allowing a local unprivileged attacker to escalate privileges to SYSTEM.</p> <p>The issue is therefore an insecure OpenSSL directory/search path combined with an unsafe filesystem permission model.</p> <p>- Proof of Concept:</p> <p>The PoC in the original advisory demonstrates that a low-privileged local user can create the otherwise missing directory and cause the SY…</p> <p><strong>Affected:</strong> Invicti Acunetix</p> <p>Acunetix 25.11.x - Local Privilege Escalation Vulnerability via OpenSSL Configuration (CVE-2026-6958)</p> <p>- Software Link:</p> <p>https://www.acunetix.com</p> <p>- Affected Versions:</p> <p>Version 25.11.x (tested on Microsoft Windows 11 and 11 IoT Enterprise LTSC) Other versions may be affected as well.</p> <p>- Vulnerability Description:</p> <p>A local privilege escalation vulnerability has been identified in Acunetix (Web Vulnerability Scanner, or abbreviated AWVS) 25.11.x The vulnerability is caused by the use of a hardcoded OpenSSL-related directory path that does not exist by default and is writable by low-privileged users. The affected binary, wvsc.exe, runs with SYSTEM privileges and attempts to load OpenSSL-related files from an hardcoded location:</p> <p>C:\builds\[PATH OMITTED]\[REDACTED]\openssl.cnf</p> <p>Since this directory does not exist by default, a low-privileged local user can create the missing directory hierarchy and place files in a location that is subsequently accessed by the SYSTEM-level process. As a result, files placed in the attacker-controlled directory may be loaded or otherwise processed by wvsc.exe with SYSTEM privileges, potentially allowing a local unprivileged attacker to escalate privileges to SYSTEM.</p> <p>The issue is therefore an insecure OpenSSL directory/search path combined with an unsafe filesystem permission model.</p> <p>- Proof of Concept:</p> <p>The PoC in the original advisory demonstrates that a low-privileged local user can create the otherwise missing directory and cause the SY…</p> https://vulnerability.circl.lu/vuln/gcve-1988-2026-0172 https://vulnerability.circl.lu/vuln/ghsa-gfg7-69hm-p6fm <p>Acunetix 25.11.251107123 for Windows contains a local privilege escalation vulnerability in the Web Vulnerability Scanning Engine (wvsc.exe) that allows low-privileged local attackers to execute arbitrary code as SYSTEM by exploiting a missing hardcoded directory path for OpenSSL-related files. Attackers can create the missing directory, place a malicious file at the expected path, and cause the SYSTEM-level wvsc.exe process to load and execute it, resulting in full privilege escalation.</p> <p>Acunetix 25.11.251107123 for Windows contains a local privilege escalation vulnerability in the Web Vulnerability Scanning Engine (wvsc.exe) that allows low-privileged local attackers to execute arbitrary code as SYSTEM by exploiting a missing hardcoded directory path for OpenSSL-related files. Attackers can create the missing directory, place a malicious file at the expected path, and cause the SYSTEM-level wvsc.exe process to load and execute it, resulting in full privilege escalation.</p> https://vulnerability.circl.lu/vuln/ghsa-gfg7-69hm-p6fm