Vulnerability · Published May 15, 2026 · Assigned by rapid7
CVE-2026-7373Metasploit Pro on Windows: Local Privilege Escalation via OpenSSL Configuration File Loading
High 8.5
In plain English
A high-severity uncontrolled search path in Metasploit Pro from Rapid7. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).
Official description
Rapid7 Metasploit Pro is vulnerable to a local privilege escalation attack that allows a user to gain SYSTEM level control of a Windows host. When started the metasploitPostgreSQL service would start the postgres.exe child process which would in turn load an OpenSSL configuration file from a static location. This static location would be writable by a pre-existing "vagrant" user, if they already existed on the system. Metasploit does not create local accounts, an Administrator would need to create it. By planting a crafted openssl.cnf file an attacker can trick the high-privilege service into executing arbitrary commands. This effectively permits the unprivileged vagrant user to bypass security controls and achieve a full host compromise under the agent's SYSTEM level access.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Rapid7 | Metasploit Pro | 5.0.0 |
Weakness: CWE-829, CWE-427, CWE-284 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:H/E:P
References
- Similar CVE Reference release-notes