Acunetix 25.11.251107123 for Windows contains a local privilege escalation vulnerability in the Web Vulnerability Scanning Engine (wvsc.exe) that allows low-privileged local attackers to execute arbitrary code as SYSTEM by exploiting a missing hardcoded directory path for OpenSSL-related files. Attackers can create the missing directory, place a malicious file at the expected path, and cause the SYSTEM-level wvsc.exe process to load and execute it, resulting in full privilege escalation.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Invicti |
|
No data.
No data.
References
History
Mon, 07 Sep 2026 08:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Invicti
Invicti acunetix |
|
| Vendors & Products |
Invicti
Invicti acunetix |
Fri, 04 Sep 2026 16:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Fri, 04 Sep 2026 15:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Acunetix 25.11.251107123 for Windows contains a local privilege escalation vulnerability in the Web Vulnerability Scanning Engine (wvsc.exe) that allows low-privileged local attackers to execute arbitrary code as SYSTEM by exploiting a missing hardcoded directory path for OpenSSL-related files. Attackers can create the missing directory, place a malicious file at the expected path, and cause the SYSTEM-level wvsc.exe process to load and execute it, resulting in full privilege escalation. | |
| Title | Acunetix 25.11.251107123 Local Privilege Escalation via wvsc.exe | |
| Weaknesses | CWE-427 | |
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published: 2026-09-04T15:06:10.359Z
Updated: 2026-09-04T15:12:14.092Z
Reserved: 2026-04-24T13:30:34.067Z
Link: CVE-2026-6958
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-09-04T15:17:35.360
Modified: 2026-09-04T16:17:57.010
Link: CVE-2026-6958
Redhat
No data.