This vulnerability (CVE-2026-8666) affects the Rapid7 InsightConnect Traceroute Plugin on Linux. The traceroute action improperly validates input parameters (host, port, max_ttl, count, time_out) before incorporating them into shell commands, leading to OS Command Injection (CWE-78). This allows remote attackers to execute arbitrary operating system commands. The CVSS 3.1 base score is 7.7, indicating high severity with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts confidentiality and integrity highly, with low impact on availability. No official remediation or patch information is currently available, and no known exploits in the wild have been reported.

Successful exploitation could allow remote attackers to execute arbitrary OS commands on the affected system, potentially leading to full compromise of confidentiality and integrity of the system, with limited impact on availability. This could result in unauthorized access, data manipulation, or further system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid exposing the traceroute action to untrusted inputs or restrict access to trusted users only. Monitor vendor channels for updates regarding patches or mitigations.