PT-2026-6046 · Rapid7 · Insightvm

CVE-2026-1568 · Publicado 2026-02-03 · Atualizado 2026-03-10

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Crítica

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Rapid7 InsightVM versions prior to 8.34.0

Description Rapid7 InsightVM installations utilizing the "Security Console" setup are susceptible to a signature verification flaw on the Assertion Consumer Service (ACS) cloud endpoint. This issue allows an attacker to potentially gain unauthorized access to InsightVM accounts, leading to a full account takeover. The application processes unsigned assertions and issues session cookies, granting access to targeted user accounts.

Recommendations Update to InsightVM version 8.34.0 or later.

Correção

Improper Verification of Cryptographic Signature

Improper Authentication

Enumeração de Fraquezas

CWE-347

CWE-287

Identificadores relacionados

CVE-2026-1568

Produtos afetados

Insightvm

Referências · 6

• https://twitter.com/TheHackerWire/status/2018736912174141754 · Publicação no Twitter
• https://twitter.com/CCBalert/status/2019124782738841866 · Publicação no Twitter
• https://twitter.com/0dayPublishing/status/2018730332263002487 · Publicação no Twitter
• https://docs.rapid7.com/insight/command-platform-release-notes · Nota
• https://reddit.com/r/Action1/comments/1rq3lpr/patch_tuesday_march_2026 · Publicação no Reddit
• https://nvd.nist.gov/vuln/detail/CVE-2026-1568 · Nota de Segurança