A Security Check Could Run an Intruder’s File
Rapid7’s Windows check called unqualified code with SYSTEM’s authority. Someone with a low-privilege local foothold could plant the file in a writable machine-level PATH entry before VS Code. CVE-2026-89325, vendor-rated 7.8 (CVSS 3.1), affects assessment packages through 0.0.261.0 independently of agent version.
Content 0.0.269.0 arrived automatically on 15 September; manual customer installation was unnecessary. The entry appeared on 23 September. This does not establish past exposure.
Reviewed vendor records report neither malicious exploitation nor a public proof-of-concept. This requires local access; missing reports do not prove absence.
Verify the content history
- Verify the fixed content landed. Check connectivity, health and reporting, including stale or isolated hosts.
- Record machine-directory write permissions and search order. Test proposed removals against legitimate software dependencies before rollout.
- Hunt for that planted filename in writable locations; review creation times, signer, hash, owner and execution history.
- Review unexpected privileged launches by the agent and its children from non-standard directories.
- Remove user-writable search entries; that reduces the broader configuration risk.
- Reconstruct historical conditions. Exposure is not evidence of compromise.
Our separate Veeam Agent report covers another mechanism with public exploit code. Both warrant agent scrutiny, not conflated products, mechanisms or exploitation status.
Sources
- Vendor record, 24 September; time unspecified.
- Supplier changelog, last updated 5 October 2026. The two event dates appear above; neither provides a time.
