CVE-2026-6958
Acunetix 25.11.251107123 for Windows contains a local privilege escalation vulnerability in the Web Vulnerability Scanning Engine (wvsc.exe)
CVSS
7.8
Alto
EPSS
—
KEV
—
Exploit Today
0
0-100
Publicado: 4 sept 2026 · Última mod.: 4 sept 2026 · CWE-427
Sin historial EPSS suficiente todavía.
Acunetix 25.11.251107123 for Windows contains a local privilege escalation vulnerability in the Web Vulnerability Scanning Engine (wvsc.exe) that allows low-privileged local attackers to execute arbitrary code as SYSTEM by exploiting a missing hardcoded directory path for OpenSSL-related files. Attackers can create the missing directory, place a malicious file at the expected path, and cause the SYSTEM-level wvsc.exe process to load and execute it, resulting in full privilege escalation.
- olografix.orghttps://olografix.org/acme/_poc/CVE-2026-6958.pdf
- seclists.orghttps://seclists.org/fulldisclosure/2026/Sep/0
- www.acunetix.comhttps://www.acunetix.com/
- www.vulncheck.comhttps://www.vulncheck.com/advisories/acunetix-local-privilege-escalation-via-wvsc-exe
- seclists.orghttp://seclists.org/fulldisclosure/2026/Sep/0
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-452217.8 ALT2.7%
——1Konga before 2.1.0 contains a privilege escalation vulnerability that allows low-privileged local attackers to execute arbitrary code by planting attacker-controlled OpenSSL configuration or library files in a hardcoded filesystem path absent from default installations. On Windows, the missing directory resides in a location writable by any authenticated local user, enabling attackers to create the directory and place malicious files that execute at the privilege level of the user or service account that launches Konga, facilitating privilege escalation.3dCVE-2026-195907.3 ALT1.1%
——0OpenAI Codex Desktop for Windows and macOS could execute attacker-controlled Git hooks because automated Git operations trusted the repository's local core.hooksPath setting. If a user opens an attacker-prepared repository whose preserved .git/config points core.hooksPath to an attacker-controlled directory, Codex can run a malicious hook while processing the repository. The hook executes outside Codex's command sandbox, without user approval, and with the user's privileges, allowing it to read, change, or delete the user's files and access other resources available to the user's account. An ordinary Git clone does not preserve the attacker-controlled repository-local configuration required for exploitation.2dCVE-2026-82649—2.2%
——1SiYuan Windows installer before version 3.8.1 (affected versions >= 2.0.14) contains an uncontrolled search path element vulnerability in its NSIS installer, which invokes system executables such as TASKKILL by name rather than by absolute path. Because NSIS nsExec::Exec resolves these calls using a search path that includes the installer's own launch directory ahead of System32, an attacker who plants a malicious executable (e.g., a renamed TASKKILL.exe) in that directory can have it executed when the installer runs. These calls occur in electron-builder's preInit hook before the license page is displayed, and with an all-users (elevated) install the planted binary executes with an elevated token, resulting in local privilege escalation.4dCVE-2026-650939.9 CRÍ43.8%
——13NVIDIA OpenShell for Linux contains a vulnerability where an attacker could cause a sandbox escape. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosure.4dCVE-2026-550155.5 MED40.4%
——12Uncontrolled search path element in Windows Remote Help allows an authorized attacker to deny service locally.15dCVE-2026-550137.1 ALT13.3%
——4Uncontrolled search path element in Windows Remote Help Defense allows an authorized attacker to perform spoofing locally.14d