CVE-2020-7382: RAPID7 Nexpose

Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days.

Rapid7 Nexpose installer version prior to 6.6.40 contains an Unquoted Search Path which may allow an attacker on the local machine to insert an arbitrary file into the executable path. This issue affects: Rapid7 Nexpose versions prior to 6.6.40.

Affected products

• RAPID7 Nexpose: before 6.6.40 (fixed in 6.6.40)

Published 2020-09-03. Last modified 2026-06-17.