CVE-2026-8664: OS Command Injection in Rapid7 InsightConnect Finger Plugin
Published Jun 25, 2026
·Updated
OS Command Injection vulnerability in Rapid7 InsightConnect Finger Plugin on Linux allows authenticated attackers to execute arbitrary OS commands via the user or host parameters due to insufficient input validation in shell command construction.
Affected Software
2 affected components
Rapid7 InsightConnect Finger Plugin
Rapid7 Insightconnect Finger Rapid7<1.0.3
Event History
Jun 25, 2026
CVE Published
via MITRE·01:28 AM
Data Sourced
via MITRE·01:28 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·02:16 AM
DescriptionSeverityWeaknessAffected Software
Jul 25, 58465
Event
via FIRST·04:13 AM
Frequently Asked Questions
1
What is the severity of CVE-2026-8664?
The severity of CVE-2026-8664 is rated as medium with a score of 6.
2
What does CVE-2026-8664 affect?
CVE-2026-8664 affects the Rapid7 InsightConnect Finger Plugin on Linux.
3
How can I mitigate CVE-2026-8664?
Mitigation for CVE-2026-8664 involves ensuring proper input validation and sanitization for user or host parameters.
4
Who can exploit CVE-2026-8664?
CVE-2026-8664 can be exploited by authenticated attackers due to its OS command injection nature.
5
What types of commands can be executed due to CVE-2026-8664?
CVE-2026-8664 allows attackers to execute arbitrary OS commands on the affected system.