High severity7.7NVD Advisory· Published Jun 25, 2026· Updated Jun 29, 2026

CVE-2026-8660

Description

OS Command Injection vulnerability in the ping action of Rapid7 InsightConnect Ping Plugin on Linux allows remote attackers to execute arbitrary OS commands via the host parameter due to insufficient input validation when constructing shell commands.

Affected products

Rapid7/Insightconnect Ping
cpe:2.3:a:rapid7:insightconnect_ping:*:*:*:*:*:rapid7:*:*
Range: <1.0.4
Rapid7/InsightConnect Sed Pluginllm-fuzzy

Patches

Vulnerability mechanics

References

extensions.rapid7.com/extension/pingnvdProduct

News mentions

No linked articles in our index yet.

cvss	0.501
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000