Executive brief
Acunetix is a web vulnerability scanner used by organizations to identify security issues in their applications. A local attacker with limited system privileges can exploit a misconfigured file path in the scanning engine to gain full system-level access, potentially allowing them to compromise the entire system and execute malicious code.
Technical details
The vulnerability is a local privilege escalation (LPE) in the Web Vulnerability Scanning Engine (wvsc.exe) caused by a hardcoded, non-existent directory path for OpenSSL configuration files embedded in the production binary from a development build. The vulnerable component references C:\builds\[PATH]\[REDACTED]\openssl.cnf, which does not exist by default and is writable by low-privileged users. Since wvsc.exe runs with SYSTEM privileges, a local unprivileged attacker can create the missing directory hierarchy and place malicious OpenSSL-related files at the hardcoded path, causing the SYSTEM-level process to load and execute them. The attack requires local file system access but no authentication or user interaction. A successful exploit grants arbitrary code execution with SYSTEM privileges, equivalent to a full system compromise.
Affected products
- Invicti Security Acunetix 25.11.x (tested on 25.11.251107123)
Timeline
- 2026-04-18: other: Vulnerability discovered
- 2026-04-23: disclosed: CNA and vendor contacted; 120-day disclosure deadline set
- 2026-08-31: disclosed: Public disclosure via Full Disclosure mailing list
- 2026-09-04: advisory: CVE-2026-6958 published