What is the CVSS score of CVE-2026-8666?

CVE-2026-8666 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of InsightConnect Traceroute Plugin are affected by CVE-2026-8666?

Rapid7's InsightConnect Traceroute Plugin contains a critical vulnerability (CVE-2026-8666, CVSS 9.8) enabling command execution within the plugin container.. A patch is available.

How to fix or mitigate CVE-2026-8666?

Within 24 hours: Identify all systems running InsightConnect Traceroute Plugin versions below 1.0.3 and evaluate business impact; restrict network access to affected instances if possible. Within 7 days: Deploy version 1.0.3 across all affected systems. Within 30 days: Verify successful patching, conduct functionality testing, and audit system logs for suspicious activity.

InsightConnect Traceroute Plugin CVE-2026-8666

EUVD-2026-39161 CRITICAL

OS Command Injection (CWE-78)

2026-06-25 rapid7

GHSA-5854-xw4j-hrh6

Command Injection Insightconnect Traceroute Plugin Rapid7

9.8

CVSS 3.1 · NVD

Severity by source

Vendor (rapid7) PRIMARY

HIGH

qualitative

NVD

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Command injection yields full impact, but invoking the plugin action realistically needs authenticated workflow access, so PR:L rather than the vendor's PR:N; network-reachable and low-complexity.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (rapid7).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jun 29, 2026 - 19:43 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 29, 2026 - 19:43 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 29, 2026 - 19:37 vuln.today

cvss_changed

Severity Changed

Jun 29, 2026 - 19:37 NVD

HIGH CRITICAL

CVSS changed

Jun 29, 2026 - 19:37 NVD

7.7 (HIGH) 9.8 (CRITICAL)

Patch available

Jun 25, 2026 - 03:01 EUVD

Analysis Generated

Jun 25, 2026 - 02:17 vuln.today

CVE Published

Jun 25, 2026 - 01:35 cve.org

HIGH 7.7

DescriptionNVD

OS Command Injection vulnerability in the traceroute action of Rapid7 InsightConnect Traceroute Plugin on Linux allows remote attackers to execute arbitrary OS commands via the host, port, max_ttl, count, or time_out request parameters due to insufficient input validation when constructing shell commands.

AnalysisAI

OS command injection in Rapid7's InsightConnect Traceroute Plugin (Linux, versions below 1.0.3) lets attackers inject arbitrary shell commands through the traceroute action's host, port, max_ttl, count, or time_out parameters, which are concatenated into a shell command without sufficient validation. Successful exploitation grants full command execution in the plugin container with the same impact on confidentiality, integrity, and availability. This was reported by the vendor (Rapid7) with a fix in 1.0.3; there is no public exploit identified at time of analysis, and EPSS sits at a modest 0.55% (42nd percentile).

Technical ContextAI

The affected component (cpe:2.3:a:rapid7:insightconnect_traceroute_plugin) is a connector plugin within the InsightConnect SOAR platform - a containerized integration that wraps the Linux traceroute utility and exposes a 'traceroute' action accepting user-supplied parameters. The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command): the plugin builds the traceroute shell invocation by string-concatenating attacker-controllable inputs (host, port, max_ttl, count, time_out) rather than passing them as isolated arguments or validating/escaping them, so shell metacharacters (e.g. ;, |, $(), backticks) break out of the intended command. Because the action targets a Linux host shell, any injected payload runs with the plugin process's privileges.

RemediationAI

Upgrade the InsightConnect Traceroute Plugin to version 1.0.3 or later, which contains the vendor fix (versions below 1.0.3 are vulnerable); the patched plugin is available from the Rapid7 extension page at https://extensions.rapid7.com/extension/traceroute. Until the plugin can be updated, disable or remove the Traceroute Plugin from active workflows so the vulnerable action cannot be invoked (trade-off: any automation depending on traceroute enrichment will break), and restrict who can trigger or edit InsightConnect workflows that call this action to trusted operators only. As defense in depth, constrain the values passed into the host/port/max_ttl/count/time_out parameters to known-good sources rather than free-form or externally-sourced input, and ensure the plugin container runs with least privilege and limited network egress to reduce blast radius if exploited.