CVE-2026-7373
Gravedad CVSS v4.0:
ALTA
Tipo:
CWE-284
Control de acceso incorrecto
Fecha de publicación:
15/05/2026
Última modificación:
15/05/2026
Descripción
*** Pendiente de traducción *** Rapid7 Metasploit Pro is vulnerable to a local privilege escalation attack that allows users to gain SYSTEM level control of a Windows host. Upon startup the metasploitPostgreSQL service the subsequent postgres.exe service attempts to load an OpenSSL configuration file from a non-existent directory that is writable by standard users. By planting a crafted openssl.cnf file an attacker can trick the high-privilege service into executing arbitrary commands. This effectively permits an unprivileged user to bypass security controls and achieve a full host compromise under the agent's SYSTEM level access.
Impacto
Puntuación base 4.0
8.50
Gravedad 4.0
ALTA