TI-2026-01492 Aliases CVE-2026-1814 GHSA-jgf7-8v7j-fwwh

Rapid7 Nexpose Insecure Java Keystore Password Generation

LOW 31CWE-331Published 2026-02-03 · Updated 2026-02-26

Key facts

Attack vector: Local
Privileges required: High
User interaction: None
Attack complexity: High
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Rapid7 Nexpose versions 6.4.50 and later are vulnerable to an insufficient entropy issue in the CredentialsKeyStorePassword.generateRandomPassword() method. When updating legacy keystore passwords, the application generates a new password with insufficient length (7-12 characters) and a static prefix 'p', resulting in a weak keyspace. An attacker with access to the nsc.ks file can brute-force this password using consumer-grade hardware to decrypt stored credentials.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00161 5th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix Fixed InsightVM/Nexpose (Rapid7): 8.36.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Rapid7	InsightVM/Nexpose	6.4.50 to before 8.36.0	8.36.0	Patch available	CNA

InsightVM/Nexpose VendorRapid7 Affected 6.4.50 to before 8.36.0 Fixed in 8.36.0 Patch available CNA

Remediation

Fix · CNA InsightVM/Nexpose (Rapid7) Fixed in 8.36.0

Timeline

2026-10-02 Threatist record created from CVE-2026-1814
2026-10-03 Alias added: GHSA-jgf7-8v7j-fwwh

References

Exploit 1

https://www.atredis.com/disclosure

TI-2023-01233 Rapid7 InsightCloudSec resource.db() method access CVSS 3.1HIGH 8.8
TI-2023-01231 Rapid7 InsightCloudSec getattr() method access CVSS 3.1HIGH 8.8
TI-2023-01232 Rapid7 InsightCloudSec box object access CVSS 3.1HIGH 8.1
TI-2024-00358 Rapid7 Minerva Armor Privilege Escalation CVSS 3.1HIGH 7.8
TI-2024-02985 Rapid7 Insight Agent Sensitive Key Exposed To Local Users CVSS 3.1MEDIUM 6.8
TI-2019-04008 Rapid7 Metasploit HTTP Handler Denial of Service CVSS 3.1HIGH 7.5

See all 139 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences