Vulnerability record · CVE-2022-0237 · published 17 March 2022

CVE-2022-0237: Rapid7 insight agent permissions and access controls vulnerability

Rapid7 · Insight Agent

Rapid7 Insight Agent versions 3.1.2.38 and earlier suffer from a privilege escalation vulnerability, whereby an attacker can hijack the flow of execution due to an unquoted argument to the runas.exe command used by the ir_agent.exe component, resulting in elevated rights and persistent access to the machine. This issue was fixed in Rapid7 Insight Agent version 3.1.3.80.

7.8 CVSS 3.1 High EPSS 0.48% · top 60.8% CWE-264 · Permissions and access controlsCWE-428 · Unquoted search path

7.8CVSS 3.1 base score, v2 7.2

0.48%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

4References, 2 tagged exploit

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Insight Agent Rapid7

References

Link	Tags
https://docs.rapid7.com/release-notes/insightagent/20220225/	Release NotesVendor Advisory
https://gist.github.com/n2dez/05d43c616f2b403e84ee55d4d7aab251	ExploitThird Party Advisory
https://docs.rapid7.com/release-notes/insightagent/20220225/	Release NotesVendor Advisory
https://gist.github.com/n2dez/05d43c616f2b403e84ee55d4d7aab251	ExploitThird Party Advisory

Track CVE-2022-0237 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.5CVE-2026-6482Rapid7 insight agent inclusion from untrusted sphere vulnerabilityThe Rapid7 Insight Agent (versions > 4.1.0.2) is vulnerable to a local privilege escalation attack that allows users to gain SYSTEM level control of …EPSS 0.19%17 Apr 2026 7.8CVE-2021-4007Rapid7 insight agent uncontrolled search path element vulnerabilityRapid7 Insight Agent, versions 3.0.1 to 3.1.2.34, suffer from a local privilege escalation due to an uncontrolled DLL search path. Specifically, when…EPSS 0.32%14 Dec 2021 7.8CVE-2019-5629Rapid7 insight agent uncontrolled search path element vulnerabilityRapid7 Insight Agent, version 2.6.3 and prior, suffers from a local privilege escalation due to an uncontrolled DLL search path. Specifically, when I…EPSS 0.94%13 Jul 2019 7.5CVE-2023-2273Rapid7 insight agent path traversal vulnerabilityRapid7 Insight Agent token handler versions 3.2.6 and below, suffer from a Directory Traversal vulnerability whereby unsanitized input from a CLI arg…EPSS 0.72%26 Apr 2023 7.2CVE-2026-4837Rapid7 insight agent vulnerabilityAn eval() injection vulnerability in the Rapid7 Insight Agent beaconing logic for Linux versions could theoretically allow an attacker to achieve rem…EPSS 0.72%8 Apr 2026 6.8CVE-2026-4482Rapid7 insight agent incorrect permission assignment vulnerabilityThe installer certificate files in the …/bootstrap/common/ssl folder do not seem to have restricted permissions on Windows systems (users have read a…EPSS 0.10%10 Apr 2026 3.3CVE-2021-4016Rapid7 insight agent improper access control vulnerabilityRapid7 Insight Agent, versions prior to 3.1.3, suffer from an improper access control vulnerability whereby, the user has access to the snapshot dire…EPSS 0.22%21 Jan 2022 5.1CVE-2015-3246libuser userhelper direct /etc/passwd write race conditionlibuser before 0.56.13-8 and 0.60 before 0.60-7, as used by the userhelper program in the usermode package, modifies /etc/passwd directly instead of …KEVEPSS 8.8%analysed11 Aug 2015

Source: NIST National Vulnerability Database (record CVE-2022-0237), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.