← Vulnerability feed

Vulnerability record · CVE-2019-5629 · published 13 July 2019

CVE-2019-5629: Rapid7 insight agent uncontrolled search path element vulnerability

Rapid7 · Insight Agent

Rapid7 Insight Agent, version 2.6.3 and prior, suffers from a local privilege escalation due to an uncontrolled DLL search path. Specifically, when Insight Agent 2.6.3 and prior starts, the Python interpreter attempts to load python3.dll at "C:\DLLs\python3.dll," which normally is writable by locally authenticated users. Because of this, a malicious local user could use Insight Agent's startup conditions to elevate to SYSTEM privileges. This issue was fixed in Rapid7 Insight Agent 2.6.4.

7.8 CVSS 3.1 High EPSS 0.94% · top 40.6% CWE-427 · Uncontrolled search path element
7.8CVSS 3.1 base score, v2 7.2
0.94%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
10References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

Rapid7 Insight Agent, version 2.6.3 and prior, suffers from a local privilege escalation due to an uncontrolled DLL search path. Specifically, when Insight Agent 2.6.3 and prior starts, the Python interpreter attempts to load python3.dll at "C:\DLLs\python3.dll," which normally is writable by locally authenticated users. Because of this, a malicious local user could use Insight Agent's startup conditions to elevate to SYSTEM privileges. This issue was fixed in Rapid7 Insight Agent 2.6.4.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://packetstormsecurity.com/files/153159/Rapid7-Windows-InsightIDR-Agent-2.6.3.14-Local-Privilege-Escalation.html Third Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2019/Jun/13 Mailing ListThird Party Advisory
https://bogner.sh/2019/06/local-privilege-escalation-in-rapid7s-windows-insight-idr-agent/ ExploitThird Party Advisory
https://help.rapid7.com/insightagent/release-notes/archive/2019/05/#20190529 Third Party Advisory
https://seclists.org/bugtraq/2019/Jun/0 Issue TrackingMailing ListThird Party Advisory
http://packetstormsecurity.com/files/153159/Rapid7-Windows-InsightIDR-Agent-2.6.3.14-Local-Privilege-Escalation.html Third Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2019/Jun/13 Mailing ListThird Party Advisory
https://bogner.sh/2019/06/local-privilege-escalation-in-rapid7s-windows-insight-idr-agent/ ExploitThird Party Advisory
https://help.rapid7.com/insightagent/release-notes/archive/2019/05/#20190529 Third Party Advisory
https://seclists.org/bugtraq/2019/Jun/0 Issue TrackingMailing ListThird Party Advisory

Track CVE-2019-5629 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.5CVE-2026-6482Rapid7 insight agent inclusion from untrusted sphere vulnerabilityThe Rapid7 Insight Agent (versions > 4.1.0.2) is vulnerable to a local privilege escalation attack that allows users to gain SYSTEM level control of …EPSS 0.19%7.8CVE-2022-0237Rapid7 insight agent permissions and access controls vulnerabilityRapid7 Insight Agent versions 3.1.2.38 and earlier suffer from a privilege escalation vulnerability, whereby an attacker can hijack the flow of execu…EPSS 0.48%7.8CVE-2021-4007Rapid7 insight agent uncontrolled search path element vulnerabilityRapid7 Insight Agent, versions 3.0.1 to 3.1.2.34, suffer from a local privilege escalation due to an uncontrolled DLL search path. Specifically, when…EPSS 0.32%7.5CVE-2023-2273Rapid7 insight agent path traversal vulnerabilityRapid7 Insight Agent token handler versions 3.2.6 and below, suffer from a Directory Traversal vulnerability whereby unsanitized input from a CLI arg…EPSS 0.72%7.2CVE-2026-4837Rapid7 insight agent vulnerabilityAn eval() injection vulnerability in the Rapid7 Insight Agent beaconing logic for Linux versions could theoretically allow an attacker to achieve rem…EPSS 0.72%6.8CVE-2026-4482Rapid7 insight agent incorrect permission assignment vulnerabilityThe installer certificate files in the …/bootstrap/common/ssl folder do not seem to have restricted permissions on Windows systems (users have read a…EPSS 0.10%3.3CVE-2021-4016Rapid7 insight agent improper access control vulnerabilityRapid7 Insight Agent, versions prior to 3.1.3, suffer from an improper access control vulnerability whereby, the user has access to the snapshot dire…EPSS 0.22%7.8CVE-2020-3433Cisco AnyConnect Windows client DLL hijacking via IPC channelCisco AnyConnect Secure Mobility Client for Windows fails to properly validate resources loaded at run time, allowing a DLL hijacking attack through …KEVEPSS 10%analysed

Source: NIST National Vulnerability Database (record CVE-2019-5629), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.