important · Privilege — Windows
A writable machine-PATH directory can make Rapid7 Insight Agent execute a local user's command as SYSTEM.
Affects
Rapid7 Insight Agent, an endpoint telemetry and assessment agent installed on Windows systems.
The assessment content invokes an unqualified command from the SYSTEM agent, allowing Windows path resolution to select a low-privilege user's planted executable.
Detail and 1 source
Rapid7 fixed and automatically distributes the corrected content, but did not identify the earliest affected build.