Vulnerability Details CVE-2026-8666
OS Command Injection vulnerability in the traceroute action of Rapid7 InsightConnect Traceroute Plugin on Linux allows remote attackers to execute arbitrary OS commands via the host, port, max_ttl, count, or time_out request parameters due to insufficient input validation when constructing shell commands.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.007
EPSS Ranking 48.5%
CVSS Severity
CVSS v3 Score 7.7
Products affected by CVE-2026-8666
-
cpe:2.3:a:rapid7:insightconnect_traceroute:1.0.0
-
cpe:2.3:a:rapid7:insightconnect_traceroute:1.0.1
-
cpe:2.3:a:rapid7:insightconnect_traceroute:1.0.2
-
cpe:2.3:o:linux:linux_kernel:-