InsightConnect SQLmap Plugin CVE-2026-8659

Requires an authenticated InsightConnect account with the ability to create or modify a SQLmap Plugin connection (PR:L), and the malicious payload must be placed specifically in the api_host or api_port parameter during connection configuration; the deployment must be the Linux build of the plugin at a version below 2.0.1. Limiting factors: this is not unauthenticated or default-exposed - exploitation hinges on the attacker already holding connection-configuration privileges within InsightConnect, there is no victim user-interaction dependency, and the plugin must actually be installed and used. These access constraints, plus SSVC Automatable=no, mean realistic risk centers on malicious or compromised insiders / over-privileged analyst accounts rather than broad remote attack.

The signals are internally consistent and point to a real but operationally bounded risk. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) shows network reachability and low complexity but requires privileges (PR:L) - the attacker must already be an authenticated InsightConnect user able to create or edit a connection, which is the primary mitigating factor. CISA SSVC reinforces a lower urgency: Exploitation = none (no observed or public exploitation), Automatable = no (the connection-configuration step is not mass-scannable/wormable), and Technical Impact = partial. EPSS is low at 0.73% (50th percentile), and there is no KEV listing and no known POC, so this is a high-CVSS issue driven by the high confidentiality/integrity/availability impact of code execution rather than by demonstrated, widespread exploitation. Net: patch on a normal prioritized cycle, treating it as a privilege-escalation/lateral-movement risk for environments where lower-trust users can configure plugin connections, not an emergency internet-facing exposure.

An authenticated InsightConnect user with permission to configure plugin connections creates or edits a SQLmap connection and embeds shell metacharacters (e.g. a command substitution) in the api_host or api_port field; when the plugin processes the connection, the injected command runs on the underlying Linux host with the plugin runtime's privileges. Given AV:N/AC:L, the action is straightforward for any such authenticated user, but no public exploit code has been identified.