CVE-2026-6958

Katalog CVE

CVSS 7.8 · High EPSS 0,18%

Kerentanan Uncontrolled Search Path Element. Skor CVSS 3.1 7.8 (High) menurut vulncheck.com.

Deskripsi (NVD)

Acunetix 25.11.251107123 for Windows contains a local privilege escalation vulnerability in the Web Vulnerability Scanning Engine (wvsc.exe) that allows low-privileged local attackers to execute arbitrary code as SYSTEM by exploiting a missing hardcoded directory path for OpenSSL-related files. Attackers can create the missing directory, place a malicious file at the expected path, and cause the SYSTEM-level wvsc.exe process to load and execute it, resulting in full privilege escalation.

Rincian

Terbit di NVD

4 September 2026

Terakhir diubah

24 September 2026

Status NVD

Deferred

CVSS 3.1

7.8 (High), sumber vulncheck.com
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-427: Uncontrolled Search Path Element

EPSS (30 hari)

0,18% peluang dieksploitasi; lebih tinggi dari 6,5% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://olografix.org/acme/_poc/CVE-2026-6958.pdf
• https://seclists.org/fulldisclosure/2026/Sep/0
• https://www.acunetix.com/
• https://www.vulncheck.com/advisories/acunetix-local-privilege-escalation-via-wvsc-exe
• http://seclists.org/fulldisclosure/2026/Sep/0