# CVE-2026-89325: Rapid7 Insight Agent uncontrolled search path element on Windows

Source: https://junglewise.ai/threats/cve-2026-89325-an-uncontrolled-search-path-element-in-insightvm-assessment  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-24. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-89325 · Severity: high · CVSS 7.8 · Published 2026-09-24

Rapid7 Insight Agent, a vulnerability assessment tool for Windows systems, contained a flaw that allowed local users without administrative privileges to execute arbitrary code with SYSTEM-level permissions. An attacker could place a malicious executable in a directory ahead of legitimate application paths to be executed with the highest system privileges, potentially leading to complete system compromise and ransomware installation.

Technologies: [Rapid7 Insight Agent](https://junglewise.ai/threats/technologies/insight-agent). Vendors: [Rapid7](https://junglewise.ai/threats/vendors/rapid7).

## Quick answers

**Is CVE-2026-89325 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-89325 being exploited in the wild.

**How severe is CVE-2026-89325?** High severity, with a CVSS score of 7.8, published 24 September 2026.

**Which products and versions are affected?** Rapid7 Insight Agent all versions while running assessment content at or below 0.0.261.0.

**Is there a fix for CVE-2026-89325?** A patch was published on 2026-09-15: Assessment content version 0.0.269.0 made generally available Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-89325 attacked?** It is attacked with local access, in a hosted service.

**Am I affected by CVE-2026-89325?** Check whether you run Rapid7 Insight Agent at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in InsightVM assessment content versions 0.0.261.0 and below, where a check invoked the `code` command without a fully qualified path from a SYSTEM-privileged process. The command resolution relied on the machine PATH environment variable at execution time; if a directory writable by non-administrators and ordered ahead of the legitimate Visual Studio Code installation contained a malicious `code` executable, it would be executed with SYSTEM privileges. The issue was resolved in assessment content version 0.0.269.0, deployed automatically on September 15, 2026.

## Affected products

- Rapid7 Insight Agent all versions while running assessment content at or below 0.0.261.0

## Timeline

- 2026-09-24: disclosed
- 2026-09-15: patched: Assessment content version 0.0.269.0 made generally available

## References

- [https://docs.rapid7.com/insight/release-notes-2026-september/](https://docs.rapid7.com/insight/release-notes-2026-september/)

## Related threats

- [Rapid7 Insight Agent privilege escalation in filesystem path handling](https://junglewise.ai/threats/cve-2026-115805-improper-handling-of-local-filesystem-paths-in-rapid7-insight)
- [Rapid7 InsightVM and Insight Agent privilege escalation via unvalidated file execution](https://junglewise.ai/threats/cve-2026-14172-rapid7-insightvm-and-insight-agent-privilege-escalation-via)
- [The Rapid7 Insight Agent (versions > 4.1.0.2) is vulnerable to a local privilege escalation attack that allows users…](https://junglewise.ai/threats/cve-2026-6482-the-rapid7-insight-agent-versions-4-1-0-2-is-vulnerable-to-a-local)
- [Rapid7 Insight Agent eval injection in Linux beaconing logic](https://junglewise.ai/threats/cve-2026-4837-rapid7-insight-agent-eval-injection-in-linux-beaconing-logic)