What is the CVSS score of CVE-2026-8658?

CVE-2026-8658 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of Insightconnect Tcpdump Plugin are affected by CVE-2026-8658?

Rapid7 InsightConnect Tcpdump Plugin versions before 2.0.0 contain an OS command injection flaw that allows authenticated low-privileged users to execute arbitrary commands on the orchestrator host.. A patch is available.

How to fix or mitigate CVE-2026-8658?

Within 24 hours: audit all InsightConnect deployments to identify Tcpdump Plugin versions and restrict low-privilege workflow creation permissions. Within 7 days: upgrade Tcpdump Plugin to version 2.0.0 or later after testing in non-production. Within 30 days: verify all production instances are patched, review access logs for workflow modifications, and implement multi-factor authentication or IP restrictions for administrative access to InsightConnect.

Insightconnect Tcpdump Plugin CVE-2026-8658

EUVD-2026-39163 HIGH

OS Command Injection (CWE-78)

2026-06-25 rapid7

GHSA-jpr4-h957-w6xg

Command Injection Insightconnect Tcpdump Plugin Rapid7

8.8

CVSS 3.1 · NVD

Severity by source

Vendor (rapid7) PRIMARY

MEDIUM

qualitative

NVD

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Authenticated plugin operator (PR:L) supplies parameters over the network (AV:N) with low complexity and no interaction; command injection yields full host compromise (C:H/I:H/A:H).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (rapid7).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jun 29, 2026 - 19:49 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 29, 2026 - 19:48 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 29, 2026 - 19:37 vuln.today

cvss_changed

Severity Changed

Jun 29, 2026 - 19:37 NVD

MEDIUM HIGH

CVSS changed

Jun 29, 2026 - 19:37 NVD

6.0 (MEDIUM) 8.8 (HIGH)

Patch available

Jun 25, 2026 - 04:16 EUVD

Analysis Generated

Jun 25, 2026 - 03:21 vuln.today

CVE Published

Jun 25, 2026 - 01:56 cve.org

MEDIUM 6.0

DescriptionNVD

OS Command Injection vulnerability in Rapid7 InsightConnect Tcpdump Plugin on Linux allows authenticated attackers to execute arbitrary OS commands via the options or filter parameters due to insufficient input sanitization in shell command construction.

AnalysisAI

OS command injection in Rapid7's InsightConnect Tcpdump Plugin (versions before 2.0.0) on Linux lets an authenticated attacker run arbitrary operating-system commands by injecting shell metacharacters into the 'options' or 'filter' parameters, which are unsafely concatenated into a tcpdump shell invocation. An attacker holding low-privileged access to a SOAR workflow that uses this plugin can fully compromise the orchestrator host (high confidentiality, integrity, and availability impact). There is no public exploit identified at time of analysis and the issue is not on the CISA KEV list; EPSS is modest at 0.73%.