This vulnerability (CVE-2026-8660) affects the Rapid7 InsightConnect Ping Plugin on Linux platforms. The issue arises from improper neutralization of special elements in the host parameter used in the ping action, leading to OS command injection (CWE-78). An attacker can exploit this flaw by supplying crafted input to the host parameter, resulting in arbitrary OS command execution. The CVSS 3.1 base score is 7.7, reflecting network attack vector, high complexity, no privileges required, no user interaction, and high impact on confidentiality and integrity with low impact on availability. No vendor advisory or patch information is currently available, and no known exploits in the wild have been reported.

Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected system, potentially leading to full compromise of confidentiality and integrity of the system. Availability impact is low. This could enable unauthorized access, data manipulation, or further system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid exposing the vulnerable ping action to untrusted inputs or restrict access to trusted users only. Monitor for vendor updates regarding patches or official mitigations.