PT-2026-41261 · Rapid7 · Metasploit Pro

Andrea Intilangelo · Published 2026-05-15 · Updated 2026-05-15 · CVE-2026-7373

Mitre

CVSS v4.0

9.3

Critical

Base vector

AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:H

Rapid7 Metasploit Pro is vulnerable to a local privilege escalation attack that allows users to gain SYSTEM level control of a Windows host. Upon startup the metasploitPostgreSQL service the subsequent postgres.exe service attempts to load an OpenSSL configuration file from a non-existent directory that is writable by standard users. By planting a crafted openssl.cnf file an attacker can trick the high-privilege service into executing arbitrary commands. This effectively permits an unprivileged user to bypass security controls and achieve a full host compromise under the agent's SYSTEM level access.

Fix

Improper Access Control

Uncontrolled Search Path Element

Weakness Enumeration

CWE-829

CWE-284

CWE-427

Related Identifiers

CVE-2026-7373

Affected Products

Metasploit Pro

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-7373 · Security Note
• https://docs.rapid7.com/insight/metasploit-pro-release-notes · Note