What is the CVSS score of CVE-2026-8665?

CVE-2026-8665 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of InsightConnect TR Plugin are affected by CVE-2026-8665?

Rapid7 InsightConnect Translate Plugin versions prior to 2.0.3 contain a critical remote code execution vulnerability (CVSS 9.8) that allows remote attackers to execute arbitrary system commands,…. A patch is available.

How to fix or mitigate CVE-2026-8665?

Within 24 hours: Identify and catalog all InsightConnect installations running Translate Plugin versions before 2.0.3, documenting each system hostname, IP address, and current plugin version. Within 7 days: Deploy Translate Plugin version 2.0.3 or later on all affected systems, coordinating with teams managing InsightConnect automation to schedule updates during appropriate maintenance windows. Within 30 days: Confirm successful patch deployment on all inventory items; audit command execution logs and system activity during the vulnerability exposure window for signs of exploitation.

InsightConnect TR Plugin CVE-2026-8665

EUVD-2026-39158 CRITICAL

OS Command Injection (CWE-78)

2026-06-25 rapid7

GHSA-4v5r-xr6m-8fwr

Command Injection Insightconnect Tr Plugin Rapid7

9.8

CVSS 3.1 · NVD

Severity by source

Vendor (rapid7) PRIMARY

HIGH

qualitative

NVD

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Description asserts remote, low-complexity command injection with no stated auth or interaction, yielding full OS command execution, so PR:N/UI:N and C/I/A all High; PR:N retained pending confirmation that the parameters are externally reachable.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (rapid7).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jun 29, 2026 - 19:46 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 29, 2026 - 19:45 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 29, 2026 - 19:37 vuln.today

cvss_changed

Severity Changed

Jun 29, 2026 - 19:37 NVD

HIGH CRITICAL

CVSS changed

Jun 29, 2026 - 19:37 NVD

7.7 (HIGH) 9.8 (CRITICAL)

Patch available

Jun 25, 2026 - 03:01 EUVD

Analysis Generated

Jun 25, 2026 - 02:16 vuln.today

CVE Published

Jun 25, 2026 - 01:12 cve.org

HIGH 7.7

DescriptionNVD

OS Command Injection vulnerability in the TR action of Rapid7 InsightConnect Translate Plugin on Linux allows remote attackers to execute arbitrary OS commands via the text or expression parameters due to insufficient input sanitization in shell command construction.

AnalysisAI

OS command injection in Rapid7's InsightConnect Translate (TR) Plugin on Linux lets remote attackers run arbitrary shell commands by injecting into the 'text' or 'expression' parameters of the TR action, which are concatenated into a shell command without sanitization (CWE-78). All plugin versions before 2.0.3 are affected. There is no public exploit identified at time of analysis and EPSS is low (0.55%), but the flaw yields full system compromise per the vendor's own SSVC 'total' technical-impact rating.

Technical ContextAI

InsightConnect is Rapid7's SOAR (Security Orchestration, Automation and Response) platform, and the TR (Translate) Plugin is an automation connector that performs text translation/expression evaluation tasks within InsightConnect workflows. The CPE 'cpe:2.3:a:rapid7:insightconnect_tr_plugin' confirms the affected component is this specific plugin rather than the broader InsightConnect orchestrator. The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command): the plugin builds a Linux shell command string by directly interpolating user-supplied 'text' or 'expression' values, so shell metacharacters (e.g. ;, |, $(), backticks) break out of the intended command and execute attacker-controlled commands in the plugin's runtime context. Because plugins run inside the InsightConnect orchestrator/connection runtime (typically containerized on Linux), command execution occurs with that process's privileges.

RemediationAI

Vendor-released patch: 2.0.3 - upgrade the InsightConnect TR Plugin to version 2.0.3 or later, which is the primary and recommended fix (vendor extension page: https://extensions.rapid7.com/extension/tr). Until the plugin is updated, reduce exposure by removing or disabling any InsightConnect workflows that invoke the TR action's text/expression parameters with externally sourced or untrusted data, and constrain those workflow inputs to trusted, validated values only (trade-off: any automation relying on the TR translate step will be paused or degraded). Restrict who can author/trigger workflows and tighten the orchestrator runtime's network egress and OS privileges to limit blast radius if injection occurs (trade-off: may interfere with legitimate plugin outbound calls). Track the official advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-8665 and https://vuldb.com/vuln/373551 for any superseding versions.