CVE-2026-89325

Name of the Vulnerable Software and Affected Versions Rapid7 Insight Agent (affected versions not specified)

Description An uncontrolled search path element in InsightVM assessment content on Windows allows a local, low-privileged user to execute arbitrary code as SYSTEM. This occurs because a check invokes the code command without a fully qualified path from a process running as SYSTEM, resolving the command against the machine PATH environment variable. If the machine PATH includes a directory writable by non-administrative users that precedes the legitimate Visual Studio Code installation, a local user can place a malicious executable named code in that directory to achieve SYSTEM privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.