Vulnerability Details CVE-2026-8666
OS Command Injection vulnerability in the traceroute action of Rapid7 InsightConnect Traceroute Plugin on Linux allows remote attackers to execute arbitrary OS commands via the host, port, max_ttl, count, or time_out request parameters due to insufficient input validation when constructing shell commands.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.006
EPSS Ranking 42.1%
CVSS Severity
CVSS v3 Score 7.7
Products affected by CVE-2026-8666
-
cpe:2.3:a:rapid7:insightconnect_traceroute:*
-
cpe:2.3:o:linux:linux_kernel:-