Acunetix 25.11.x - Local Privilege Escalation Vulnerability via OpenSSL Configuration (CVE-2026-6958)
Andrea Intilangelo ·
Acunetix 25.11.x - Local Privilege Escalation Vulnerability via OpenSSL Configuration (CVE-2026-6958) - Software Link: https://www.acunetix.com - Affected Versions: Version 25.11.x (tested on Microsoft Windows 11 and 11 IoT Enterprise LTSC) Other versions may be affected as well. - Vulnerability Description: A local privilege escalation vulnerability has been identified in Acunetix (Web Vulnerability Scanner, or abbreviated AWVS) 25.11.x The vulnerability is caused by the use of a hardcoded OpenSSL-related directory path that does not exist by default and is writable by low-privileged users. The affected binary, wvsc.exe, runs with SYSTEM privileges and attempts to load OpenSSL-related files from an hardcoded location: C:\builds\[PATH OMITTED]\[REDACTED]\openssl.cnf Since this directory does not exist by default, a low-privileged local user can create the missing directory hierarchy and place files in a location that is subsequently accessed by the SYSTEM-level process. As a result, files placed in the attacker-controlled directory may be loaded or otherwise processed by wvsc.exe with SYSTEM privileges, potentially allowing a local unprivileged attacker to escalate privileges to SYSTEM. The issue is therefore an insecure OpenSSL directory/search path combined with an unsafe filesystem permission model. - Proof of Concept: The PoC in the original advisory demonstrates that a low-privileged local user can create the otherwise missing directory and cause the SYSTEM-level wvsc.exe process to access attacker-controlled OpenSSL-related files from that location. - Impact: A local attacker with low privileges can potentially execute code with SYSTEM-level privileges, depending on the OpenSSL-related file being loaded and the execution path reached by wvsc.exe. - Solution: The vendor should remove references to development/build-time paths from production binaries and ensure that all OpenSSL-related files are loaded only from trusted, administrator-controlled directories. Additionally, filesystem permissions should prevent unprivileged users from creating or modifying directories used by privileged processes. - Disclosure Timeline: [18/04/2026] - Vulnerability discovered [23/04/2026] - CNA and vendor contacted [23/04/2026] - Vulnerability details provided - deadline set at 120 days, in accordance with the CNA disclosure policy [ meantime ] - Multiple follow-up attempts by the CNA to the vendor; Invicti Security repeatedly replied with same standard message [31/08/2026] - Public disclosure - CVE Reference: CVE-2026-6958 has been assigned to this vulnerability. - Credits: Vulnerability discovered by Andrea Intilangelo - Original Advisory: https://olografix.org/acme/_poc/CVE-2026-6958.pdf _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/