Rapid7 Metasploit Pro is vulnerable to a local privilege escalation attack that allows a user to gain SYSTEM level control of a Windows host. When started the metasploitPostgreSQL service would start the postgres.exe child process which would in turn load an OpenSSL configuration file from a static location. This static location would be writable by a pre-existing "vagrant" user, if they already existed on the system. Metasploit does not create local accounts, an Administrator would need to create it. By planting a crafted openssl.cnf file an attacker can trick the high-privilege service into executing arbitrary commands. This effectively permits the unprivileged vagrant user to bypass security controls and achieve a full host compromise under the agent's SYSTEM level access.
CVSS
No CVSS.
References
Configurations
No configuration.
History
No history.
Information
Published : 2026-05-15 03:16
Updated : 2026-06-17 11:02
NVD link : CVE-2026-7373
Mitre link : CVE-2026-7373
CVE.ORG link : CVE-2026-7373
JSON object : View
Products Affected
No product.