PT-2026-52187 · Rapid7 · Insightconnect Traceroute Plugin

Publicado 2026-06-25 · Atualizado 2026-06-25 · CVE-2026-8666

Mitre

CVSS v3.1

7.7

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

OS Command Injection vulnerability in the traceroute action of Rapid7 InsightConnect Traceroute Plugin on Linux allows remote attackers to execute arbitrary OS commands via the host, port, max ttl, count, or time out request parameters due to insufficient input validation when constructing shell commands.

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2026-8666

Produtos afetados

Insightconnect Traceroute Plugin

Referências · 2

• https://extensions.rapid7.com/extension/traceroute · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-8666 · Nota de Segurança