PT-2026-52187 · Rapid7 · Insightconnect Traceroute Plugin

Published 2026-06-25 · Updated 2026-06-25 · CVE-2026-8666

Mitre

CVSS v3.1

7.7

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

OS Command Injection vulnerability in the traceroute action of Rapid7 InsightConnect Traceroute Plugin on Linux allows remote attackers to execute arbitrary OS commands via the host, port, max ttl, count, or time out request parameters due to insufficient input validation when constructing shell commands.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-8666

Affected Products

Insightconnect Traceroute Plugin

References · 2

• https://extensions.rapid7.com/extension/traceroute · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-8666 · Security Note