CVE-2026-4482 Rapid7 CVE debrief

Who should care

System administrators and security teams responsible for Insight Agent installations on Windows systems should assess exposure and verify permissions on certificate files. They should also restrict access to certificate files as needed to prevent unauthorized access. This vulnerability affects Insight Agent installations on Windows systems, requiring prompt attention from security teams and system administrators to verify and remediate potential exposure.

Why it matters

CVE-2026-4482 exposes agent identity material due to weak permissions on installer certificate files in Insight Agent on Windows systems, requiring verification and potential remediation.

• Verify permissions on certificate files to prevent exposure of agent identity material
• Assess exposure of Insight Agent installations on Windows systems to potential local attacks
• Restrict access to certificate files as needed to prevent unauthorized access

Technical summary

The installer certificate files in the …/bootstrap/common/ssl folder do not have restricted permissions on Windows systems, potentially exposing agent identity material. The client.key file could lead to exploits as it exposes agent identity material to any locally authenticated standard user. This vulnerability has a CVSS score of 6.8 and is classified as MEDIUM severity. Affected systems require verification of certificate file permissions and potential remediation to restrict access as needed. This issue requires immediate attention from system administrators and security teams.

Defensive priority

Assess exposure of Insight Agent installations on Windows systems, verify permissions on certificate files, and restrict access as needed.

Recommended defensive actions

• Assess exposure of Insight Agent installations on Windows systems
• Verify permissions on certificate files in …/bootstrap/common/ssl folder
• Restrict access to certificate files as needed
• Review Insight Agent version and update to 4.1.0.2 or later if necessary
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry indicate that the installer certificate files in the …/bootstrap/common/ssl folder have weak permissions on Windows systems, potentially exposing agent identity material. The client.key file in particular could lead to exploits as it exposes agent identity material to any locally authenticated standard user. Evidence is limited to CVE and NVD entries; further verification is recommended.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.