CVE-2026-8663: OS Command Injection in Rapid7 InsightConnect RPM Plugin
Analyzed
Published 24-06-2026Last modified 25-06-2026
Vulnerability summary
CVE-2026-8663 is a high (CVSS 8.8) OS Command Injection vulnerability in rapid7 insightconnect_rpm. EPSS estimates a 1.29% chance of exploitation in the next 30 days, higher than 70% of scored vulnerabilities.
CVSS score
8.8/10
010
High · v3.1 (NVD)EPSS score
1.29%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Timeline
- 24-06-2026PublishedVulnerability first disclosed.
- 25-06-2026Last modifiedVulnerability information updated.
Description
OS Command Injection vulnerability in Rapid7 InsightConnect RPM Plugin on Linux allows authenticated attackers to execute arbitrary OS commands via the repo, key, or name parameters due to insufficient input sanitization in shell command construction.
CVSS metrics
2 scores · 2 sources · 1 versionHigh 8.8Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSources2 sources · 6.0–8.8
- CVE.orgCNA6.0MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:LDiffers
EPSS trend
Probability
1.29%
Chance of exploitation in the next 30 days
Percentile
70%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.29% on 22-09-2026
22-09-202622-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Rapid72 products
- insightconnect_rpm< 1.0.2
- insightconnect rpm plugin< 1.0.2
1 vendor · 2 products