Description

Acunetix 25.11.251107123 for Windows contains a local privilege escalation vulnerability in the Web Vulnerability Scanning Engine (wvsc.exe) that allows low-privileged local attackers to execute arbitrary code as SYSTEM by exploiting a missing hardcoded directory path for OpenSSL-related files. Attackers can create the missing directory, place a malicious file at the expected path, and cause the SYSTEM-level wvsc.exe process to load and execute it, resulting in full privilege escalation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-04T15:17:35.360Z",
  "pubdate": "2026-09-04T15:17:35.360Z",
  "executiveSummary": "Acunetix 25.11.251107123 for Windows is susceptible to a local privilege escalation vulnerability within the Web Vulnerability Scanning Engine (wvsc.exe). This vulnerability is classified as an insecure library loading or search path issue, stemming from the application's failure to validate the existence of specific directory paths required for OpenSSL-related operations. An attacker with low-privileged access to the local system can exploit this weakness by creating the missing directory structure and injecting a malicious dynamic link library (DLL) or executable component that the application expects to load. Because the wvsc.exe process executes with SYSTEM privileges, the successful loading of a malicious file results in the execution of arbitrary code with the highest level of system authority. This vulnerability poses a significant risk to the integrity and confidentiality of the host operating system, as it allows a standard user to gain full administrative control. Exploitation does not require network access, as the attack is performed locally, but it does necessitate the ability to create file system objects in the target path.",
  "technicalDetails": "The vulnerability resides in the Web Vulnerability Scanning Engine (wvsc.exe), a core component of Acunetix 25.11.251107123 for Windows. The root cause is a flaw in the application's environment initialization or library loading mechanism, which looks for specific OpenSSL-related files in a directory path that is not strictly protected or pre-initialized by the installer.\nWhen the wvsc.exe process is initiated—typically under a SYSTEM-level security context—it attempts to resolve dependencies or load configuration files from a hardcoded directory path. If this directory is missing, the application proceeds to search for the expected resources. By identifying the target path, a local low-privileged attacker can utilize standard file system APIs to create the necessary directory structure.\nThe exploitation flow proceeds as follows: 1) The attacker identifies the hardcoded directory path that the application attempts to access during its startup routine or specific functional execution. 2) The attacker creates this directory structure on the local file system. 3) The attacker places a crafted malicious file (such as a DLL, if the application is performing binary loading) into this path, naming it to match the expected filename that wvsc.exe seeks. 4) Upon triggering the wvsc.exe process, the application inadvertently loads the attacker-supplied file instead of the intended system component. 5) Since the wvsc.exe process operates with SYSTEM-level privileges, the code within the malicious file is executed within that elevated security context.\nThe component affected is the wvsc.exe engine, which is responsible for executing vulnerability scans. Because this engine is designed to run with high privileges to perform deep system and network inspection, any compromise of its execution flow results in full system-level administrative access. This attack does not require prior authentication to the application itself; it relies solely on the local attacker's capability to manipulate the file system environment before the service or application component is invoked. The post-exploitation impact is catastrophic, as the attacker achieves persistence and full administrative control over the host machine, bypassing existing user-level access controls."
}