PT-2026-6046 · Rapid7 · Insightvm

Published 2026-02-03 · Updated 2026-03-10 · CVE-2026-1568

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Rapid7 InsightVM versions prior to 8.34.0

Description Rapid7 InsightVM installations utilizing the "Security Console" setup are susceptible to a signature verification flaw on the Assertion Consumer Service (ACS) cloud endpoint. This issue allows an attacker to potentially gain unauthorized access to InsightVM accounts, leading to a full account takeover. The application processes unsigned assertions and issues session cookies, granting access to targeted user accounts.

Recommendations Update to InsightVM version 8.34.0 or later.

Fix

Improper Verification of Cryptographic Signature

Improper Authentication

Weakness Enumeration

CWE-347

CWE-287

Related Identifiers

CVE-2026-1568

Affected Products

Insightvm

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-1568 · Security Note
• https://twitter.com/TheHackerWire/status/2018736912174141754 · Twitter Post
• https://twitter.com/CCBalert/status/2019124782738841866 · Twitter Post
• https://twitter.com/0dayPublishing/status/2018730332263002487 · Twitter Post
• https://docs.rapid7.com/insight/command-platform-release-notes · Note
• https://reddit.com/r/Action1/comments/1rq3lpr/patch_tuesday_march_2026 · Reddit Post