by Kastro
Paper/Archive/CVE-2026-8666

CVE-2026-8666

Rapid7 InsightConnect Traceroute Plugin — OS Command Injection in Rapid7 InsightConnect Traceroute Plugin

EPSS 1%CVSS 9.8
critical.is priorityof 100
43
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 68.0.680 × 2013.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

OS Command Injection vulnerability in the traceroute action of Rapid7 InsightConnect Traceroute Plugin on Linux allows remote attackers to execute arbitrary OS commands via the host, port, max_ttl, count, or time_out request parameters due to insufficient input validation when constructing shell commands.

Affected

ProductAffectedFixed inSource
InsightConnect Traceroute Plugin< 1.0.31.0.3CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
rapid7 (CNA)7.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

advisoryextensions.rapid7.com/extension/traceroute