[FD] Acunetix 25.11.x - Local Privilege Escalation Vulnerability via OpenSSL Configuration (CVE-2026-6958)

["Andrea Intilangelo" <andrea@xxxxxxxxxxxxxx>]

Acunetix 25.11.x - Local Privilege Escalation Vulnerability via OpenSSL 
Configuration (CVE-2026-6958)

- Software Link:

https://www.acunetix.com

- Affected Versions:

Version 25.11.x (tested on Microsoft Windows 11 and 11 IoT Enterprise LTSC)
Other versions may be affected as well.

- Vulnerability Description:

A local privilege escalation vulnerability has been identified in Acunetix (Web 
Vulnerability Scanner, or abbreviated AWVS) 25.11.x
The vulnerability is caused by the use of a hardcoded OpenSSL-related directory 
path that does not exist by default and is writable by low-privileged users.
The affected binary, wvsc.exe, runs with SYSTEM privileges and attempts to load 
OpenSSL-related files from an hardcoded location:

C:\builds\[PATH OMITTED]\[REDACTED]\openssl.cnf

Since this directory does not exist by default, a low-privileged local user can 
create the missing directory hierarchy and place files in a location that is 
subsequently accessed by the SYSTEM-level process.
As a result, files placed in the attacker-controlled directory may be loaded or 
otherwise processed by wvsc.exe with SYSTEM privileges, potentially allowing a 
local unprivileged attacker to escalate privileges to SYSTEM.

The issue is therefore an insecure OpenSSL directory/search path combined with 
an unsafe filesystem permission model.

- Proof of Concept:

The PoC in the original advisory demonstrates that a low-privileged local user 
can create the otherwise missing directory and cause the SYSTEM-level wvsc.exe 
process to access attacker-controlled OpenSSL-related files from that location.

- Impact:

A local attacker with low privileges can potentially execute code with 
SYSTEM-level privileges, depending on the OpenSSL-related file being loaded and 
the execution path reached by wvsc.exe.

- Solution:

The vendor should remove references to development/build-time paths from 
production binaries and ensure that all OpenSSL-related files are loaded only 
from trusted, administrator-controlled directories.

Additionally, filesystem permissions should prevent unprivileged users from 
creating or modifying directories used by privileged processes.

- Disclosure Timeline:

[18/04/2026] - Vulnerability discovered
[23/04/2026] - CNA and vendor contacted
[23/04/2026] - Vulnerability details provided - deadline set at 120 days, in 
accordance with the CNA disclosure policy
[ meantime ] - Multiple follow-up attempts by the CNA to the vendor; Invicti 
Security repeatedly replied with same standard message
[31/08/2026] - Public disclosure

- CVE Reference:

CVE-2026-6958 has been assigned to this vulnerability.

- Credits:

Vulnerability discovered by Andrea Intilangelo

- Original Advisory:

https://olografix.org/acme/_poc/CVE-2026-6958.pdf

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/