CVE-2026-6958
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
Acunetix for Windows contains a local privilege escalation vulnerability in the Web Vulnerability Scanning Engine (wvsc.exe). A low-privileged attacker can exploit a missing hardcoded directory path for OpenSSL-related files to execute arbitrary code as SYSTEM.
Risk Assessment
An attacker with low privileges can gain full control over the system, leading to complete security compromise and potential takeover of the infrastructure.
Recommendation
It is recommended to immediately update Acunetix to a patched version and restrict local system access to trusted users only.
Other vulnerabilities in Acunetix
Original NVD description (English source)
Acunetix 25.11.251107123 for Windows contains a local privilege escalation vulnerability in the Web Vulnerability Scanning Engine (wvsc.exe) that allows low-privileged local attackers to execute arbitrary code as SYSTEM by exploiting a missing hardcoded directory path for OpenSSL-related files. Attackers can create the missing directory, place a malicious file at the expected path, and cause the SYSTEM-level wvsc.exe process to load and execute it, resulting in full privilege escalation.