InsightConnect RPM Plugin CVE-2026-8663

Exploitation requires an authenticated InsightConnect account or the ability to control workflow input (CVSS PR:L - low privileges, not unauthenticated), and the InsightConnect RPM Plugin (version < 1.0.2) must be installed and used so the attacker can invoke an action that consumes the repo, key, or name parameters, with those values reaching the plugin's shell-command construction path. Limiting factors: it is not exploitable without valid low-level access (PR:L), it is confined to deployments that actually use this specific Linux RPM Plugin, and CISA SSVC marks it Automatable=no, indicating it is not trivially mass-exploitable. No user interaction is required (UI:N).

The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a low-complexity, network-reachable attack requiring only low privileges, with full confidentiality, integrity and availability impact - consistent with arbitrary command execution. However, several lower-urgency signals temper this: SSVC reports Exploitation = none, Automatable = no, and Technical Impact = partial; EPSS is low at 0.73% (50th percentile); the CVE is not on CISA KEV; and no POC is referenced. The SSVC 'Technical Impact: partial' rating sits in mild tension with the CVSS C:H/I:H/A:H, suggesting CISA viewed the impact as scoped to the plugin's execution context rather than full host control - verify the plugin's runtime privilege level with the vendor. Net assessment: a genuinely serious authenticated RCE primitive, but real-world urgency is moderated by the authentication requirement, absence of observed exploitation, and the niche deployment footprint. Patch promptly, but absent evidence of exploitation this is not a drop-everything emergency.

An attacker who already holds a low-privilege InsightConnect account (or who can influence a workflow's input) supplies a crafted value such as a package name containing ';' followed by an arbitrary command into the RPM Plugin's name, repo, or key field. When the plugin builds and runs its shell command, the injected payload executes on the underlying Linux host with the plugin's privileges. No public POC is referenced, but the low attack complexity (AC:L) makes a working exploit straightforward to develop.