CVE-2026-1568: rapid7 vulnerability management Improper Authentication
Vulnerability summary
CVE-2026-1568 is a critical (CVSS 9.6) Improper Authentication vulnerability in rapid7 vulnerability management. EPSS estimates a 0.16% chance of exploitation in the next 30 days, higher than 4.9% of scored vulnerabilities.
Timeline
- 03-02-2026PublishedVulnerability first disclosed.
- 26-02-2026Last modifiedVulnerability information updated.
Description
Rapid7 InsightVM versions before 8.34.0 contain a signature verification issue on the Assertion Consumer Service (ACS) cloud endpoint that could allow an attacker to gain unauthorized access to InsightVM accounts setup via "Security Console" installations, resulting in full account takeover. The issue occurs due to the application processing these unsigned assertions and issuing session cookies that granted access to the targeted user accounts. This has been fixed in version 8.34.0 of InsightVM.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST9.6CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
EPSS trend
Probability
0.16%
Chance of exploitation in the next 30 days
Percentile
5%
Versus all other CVEs
30-day change
+0.01 pp
From 0.15% on 22-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
- CWE-347Improper Verification of Cryptographic SignatureThe product does not verify, or incorrectly verifies, the cryptographic signature for data.
Affected systems
Rapid71 product
- vulnerability management< 8.34.0
1 vendor · 1 product