What is the CVSS score of CVE-2026-1568?

CVE-2026-1568 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Rapid7 InsightVM are affected by CVE-2026-1568?

A critical authentication bypass vulnerability in Rapid7 InsightVM could allow attackers to completely compromise any InsightVM account using cloud-based Security Console deployments.

How to fix or mitigate CVE-2026-1568?

Within 24 hours: Inventory all InsightVM deployments and identify those using Security Console with cloud ACS endpoints; disable remote cloud access if operationally feasible and switch to on-premises authentication. Within 7 days: Implement network-level restrictions to limit ACS endpoint access to known trusted IP ranges; enable enhanced logging and monitoring for authentication anomalies. Within 30 days: Upgrade to InsightVM 8.34.0 or later immediately upon patch availability; conduct forensic review of access logs for unauthorized activity.

Rapid7 InsightVM CVE-2026-1568

CRITICAL

Improper Authentication (CWE-287)

2026-02-03 cve@rapid7.com

Authentication Bypass

9.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Feb 03, 2026 - 17:15 nvd

CRITICAL 9.6

DescriptionCVE.org

Rapid7 InsightVM versions before 8.34.0 contain a signature verification issue on the Assertion Consumer Service (ACS) cloud endpoint that could allow an attacker to gain unauthorized access to InsightVM accounts setup via "Security Console" installations, resulting in full account takeover. The issue occurs due to the application processing these unsigned assertions and issuing session cookies that granted access to the targeted user accounts. This has been fixed in version 8.34.0 of InsightVM.

AnalysisAI

Rapid7 InsightVM before 8.34.0 has a SAML signature verification bypass (CVSS 9.6) allowing attackers to forge authentication assertions and gain unauthorized access.

Technical ContextAI

Rapid7 InsightVM < 8.34.0 has a CWE-287 improper authentication vulnerability in the SAML Assertion Consumer Service (ACS) where signature verification is insufficient, allowing attackers to forge SAML assertions.