What is the CVSS score of CVE-2026-8660?

CVE-2026-8660 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of Insightconnect Ping Plugin are affected by CVE-2026-8660?

Rapid7's InsightConnect Ping Plugin (versions before 1.0.4) allows remote code execution on plugin hosts through command injection, directly compromising organizations' security orchestration…. A patch is available.

How to fix or mitigate CVE-2026-8660?

24 hours: Identify all InsightConnect deployments and determine if Rapid7 Ping Plugin versions earlier than 1.0.4 are in use; document plugin configurations and data flows. 7 days: Apply vendor patch to upgrade Ping Plugin to version 1.0.4 or later across all affected instances and validate plugin functionality. 30 days: Conduct post-patch validation through plugin integration testing and review access controls for ping action inputs to ensure only authorized sources can trigger the plugin.

Insightconnect Ping Plugin CVE-2026-8660

EUVD-2026-39157 CRITICAL

OS Command Injection (CWE-78)

2026-06-25 rapid7

GHSA-83v3-8pj5-wm26

Command Injection Insightconnect Ping Plugin Rapid7

9.8

CVSS 3.1 · NVD

Severity by source

Vendor (rapid7) PRIMARY

HIGH

qualitative

NVD

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable, low-complexity command injection with total impact, but supplying the host input to a workflow action realistically requires at least low-privileged operator access, so PR:L over PR:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (rapid7).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jun 29, 2026 - 19:48 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 29, 2026 - 19:46 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 29, 2026 - 19:37 vuln.today

cvss_changed

Severity Changed

Jun 29, 2026 - 19:37 NVD

HIGH CRITICAL

CVSS changed

Jun 29, 2026 - 19:37 NVD

7.7 (HIGH) 9.8 (CRITICAL)

Patch available

Jun 25, 2026 - 03:01 EUVD

Analysis Generated

Jun 25, 2026 - 02:15 vuln.today

CVE Published

Jun 25, 2026 - 00:52 cve.org

HIGH 7.7

DescriptionNVD

OS Command Injection vulnerability in the ping action of Rapid7 InsightConnect Ping Plugin on Linux allows remote attackers to execute arbitrary OS commands via the host parameter due to insufficient input validation when constructing shell commands.

AnalysisAI

OS command injection in Rapid7's InsightConnect Ping Plugin (versions before 1.0.4) on Linux lets attackers run arbitrary operating-system commands by injecting shell metacharacters into the host parameter of the plugin's ping action, which is concatenated into a shell command without proper sanitization. Any actor able to influence the host input flowing into this SOAR plugin gains full code execution on the plugin's runtime host. There is no public exploit identified at time of analysis, EPSS is low (0.55%), and CISA's SSVC marks exploitation as 'none' and the flaw as not automatable, so risk is real but not yet observed in the wild.