What is the CVSS score of CVE-2026-8663?

CVE-2026-8663 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of InsightConnect RPM Plugin are affected by CVE-2026-8663?

Rapid7 InsightConnect RPM Plugin (versions before 1.0.2) contains an authenticated command injection vulnerability (CVSS 8.8) allowing users with valid credentials to execute arbitrary system…. A patch is available.

How to fix or mitigate CVE-2026-8663?

Within 24 hours: Inventory all InsightConnect deployments to identify versions running RPM Plugin before 1.0.2. Within 7 days: Upgrade InsightConnect RPM Plugin to version 1.0.2 or later on all affected systems; for systems unable to patch immediately, restrict authenticated user access to the plugin. Within 30 days: Confirm successful patch deployment across all instances; audit plugin activity logs for exploitation attempts and unauthorized command execution.

InsightConnect RPM Plugin CVE-2026-8663

EUVD-2026-39151 HIGH

OS Command Injection (CWE-78)

2026-06-24 rapid7

GHSA-82jg-f393-8r2g

Command Injection Insightconnect Rpm Plugin Rapid7

8.8

CVSS 3.1 · NVD

Severity by source

Vendor (rapid7) PRIMARY

MEDIUM

qualitative

NVD

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable plugin action with low complexity and no user interaction, requiring an authenticated low-privilege account (PR:L); arbitrary command execution yields full C/I/A impact within the plugin's scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (rapid7).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jun 29, 2026 - 19:55 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 29, 2026 - 19:52 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 29, 2026 - 19:37 vuln.today

cvss_changed

Severity Changed

Jun 29, 2026 - 19:37 NVD

MEDIUM HIGH

CVSS changed

Jun 29, 2026 - 19:37 NVD

6.0 (MEDIUM) 8.8 (HIGH)

Patch available

Jun 25, 2026 - 02:01 EUVD

Analysis Generated

Jun 25, 2026 - 00:33 vuln.today

CVE Published

Jun 24, 2026 - 23:56 cve.org

MEDIUM 6.0

DescriptionNVD

OS Command Injection vulnerability in Rapid7 InsightConnect RPM Plugin on Linux allows authenticated attackers to execute arbitrary OS commands via the repo, key, or name parameters due to insufficient input sanitization in shell command construction.

AnalysisAI

OS command injection in the Rapid7 InsightConnect RPM Plugin on Linux lets authenticated users run arbitrary operating-system commands by injecting shell metacharacters into the repo, key, or name parameters, which are concatenated into a shell command without sanitization (CWE-78). All versions before 1.0.2 are affected. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.73%, 50th percentile).

Technical ContextAI

InsightConnect is Rapid7's SOAR (Security Orchestration, Automation and Response) platform, and the RPM Plugin is an automation connector that wraps Linux RPM package-management operations so workflows can query or manage packages on hosts. The flaw is a classic CWE-78 OS Command Injection: the user-controlled repo, key, and name parameters are interpolated directly into a shell command string rather than passed as discrete, escaped arguments, so shell metacharacters (e.g. ;, |, $(), backticks) can break out of the intended command. The single CPE in scope is cpe:2.3:a:rapid7:insightconnect_rpm_plugin, confirming the issue is isolated to this specific plugin rather than the broader InsightConnect orchestrator.

RemediationAI

Vendor-released patch: 1.0.2 - upgrade the InsightConnect RPM Plugin to version 1.0.2 or later, the first release outside the affected '<1.0.2' range; obtain it from the Rapid7 extension page at https://extensions.rapid7.com/extension/rpm (see also EUVD-2026-39151 / https://nvd.nist.gov/vuln/detail/CVE-2026-8663). Until the plugin is updated, limit blast radius by restricting which InsightConnect users and workflows can invoke the RPM Plugin actions (trade-off: may disable legitimate package-automation jobs), and validate or reject any workflow input flowing into the repo, key, or name parameters so shell metacharacters cannot pass through (trade-off: strict filtering can break legitimate values containing special characters). Run the plugin connector with the least OS privilege necessary so a successful injection does not execute as root (trade-off: package operations needing elevation may fail). Because the exact patched build is inferred from the EUVD affected-version boundary rather than an explicit changelog entry, confirm the fixed version directly with Rapid7 before relying on it.