CVE-2026-7373: RAPID7 Metasploit Pro

High severity, CVSS 8.5. EPSS: 0.2% chance of exploitation in the next 30 days.

Rapid7 Metasploit Pro is vulnerable to a local privilege escalation attack that allows a user to gain SYSTEM level control of a Windows host. When started the metasploitPostgreSQL service would start the postgres.exe child process which would in turn load an OpenSSL configuration file from a static location. This static location would be writable by a pre-existing "vagrant" user, if they already existed on the system. Metasploit does not create local accounts, an Administrator would need to create it. By planting a crafted openssl.cnf file an attacker can trick the high-privilege service into executing arbitrary commands. This effectively permits the unprivileged vagrant user to bypass security controls and achieve a full host compromise under the agent's SYSTEM level access.

Affected products

• RAPID7 Metasploit Pro: version 5.0.0 only

Published 2026-05-15. Last modified 2026-06-17.