CVE-2026-6958

Acunetix 25.11.251107123 for Windows is vulnerable to a local privilege escalation flaw (CWE-427, uncontrolled search path element) in its Web Vulnerability Scanning Engine (wvsc.exe), which runs as SYSTEM but does not hardcode the directory path used for OpenSSL-related files. A low-privileged local attacker can create the missing directory, drop a malicious file at the expected path, and cause the SYSTEM-level wvsc.exe process to load and execute it, resulting in arbitrary code execution as SYSTEM and full compromise of the host. Organizations running the named Acunetix for Windows build are affected; because the attack vector is local, remote-only attackers cannot exploit it directly. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known, and EPSS currently estimates only a 0.1% probability of exploitation within 30 days.

What to do: Upgrade Acunetix for Windows to a build newer than 25.11.251107123 per vendor guidance (no fixed version number is available in this data). Until patched, restrict interactive logon and untrusted local users on hosts running the scanner, since exploitation requires low-privileged local access, and check for unexpected files in OpenSSL-related directories that wvsc.exe loads. Because successful exploitation grants SYSTEM rights, treat any scanner host with local account compromise as fully compromised.