Quick answers
- Is CVE-2026-89325 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-89325 being exploited in the wild.
- How severe is CVE-2026-89325?
- High severity, with a CVSS score of 7.8, published 24 September 2026.
- Which products and versions are affected?
- Rapid7 Insight Agent all versions while running assessment content at or below 0.0.261.0.
- Is there a fix for CVE-2026-89325?
- A patch was published on 2026-09-15: Assessment content version 0.0.269.0 made generally available Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-89325 attacked?
- It is attacked with local access, in a hosted service.
- Am I affected by CVE-2026-89325?
- Check whether you run Rapid7 Insight Agent at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability exists in InsightVM assessment content versions 0.0.261.0 and below, where a check invoked the `code` command without a fully qualified path from a SYSTEM-privileged process. The command resolution relied on the machine PATH environment variable at execution time; if a directory writable by non-administrators and ordered ahead of the legitimate Visual Studio Code installation contained a malicious `code` executable, it would be executed with SYSTEM privileges. The issue was resolved in assessment content version 0.0.269.0, deployed automatically on September 15, 2026.
Affected products
- Rapid7 Insight Agent all versions while running assessment content at or below 0.0.261.0
Timeline
- 2026-09-24: disclosed
- 2026-09-15: patched: Assessment content version 0.0.269.0 made generally available