CVE-2026-7373

Name of the Vulnerable Software and Affected Versions Rapid7 Metasploit Pro (affected versions not specified)

Description Rapid7 Metasploit Pro on Windows is subject to a local privilege escalation. During startup, the metasploitPostgreSQL service and the subsequent postgres.exe service attempt to load an OpenSSL configuration file from a non-existent directory that standard users can write to. An attacker can place a crafted openssl.cnf file in that location to trick the high-privilege service into executing arbitrary commands, allowing an unprivileged user to gain SYSTEM level control of the host.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.