CVE-2026-8660 is an OS command injection in the ping action of the Rapid7 InsightConnect Ping plugin on Linux (CVSS 7.7, high). The host parameter is used to build shell commands without enough validation. Update the plugin. The sections below cover affected versions, how to check your exposure and what to do first.
What's affected
The record names the Rapid7 InsightConnect Ping plugin on Linux, specifically the ping action and its host parameter. The weakness is CWE-78, OS command injection. The record is not in the CISA KEV catalog.
No fixed version is given in the record, and the extension page did not return readable content for me, so check the plugin page for the latest release.
How to check if you're exposed
In InsightConnect, find the installed version of the Ping plugin and compare it with the version on the Rapid7 extension page. Review workflows that call the ping action and where the host value comes from, such as alert fields, tickets or user forms.
What to do now
- Update the Ping plugin to the latest published version.
- Review workflows where the host value comes from an outside source.
- Validate host values as an address or hostname before they reach the plugin, as a stopgap.
- Run the orchestrator with limited privileges.
- Remove the plugin if you do not use it.
Why it matters
A ping tool seems harmless, but it runs a program on the host with values from your workflow. If those values are not checked, a host field can carry extra shell syntax.
Inputs to automation often come from alerts and tickets, which attackers can influence indirectly. Treat them as untrusted, even when they sit inside your own tools.
Quick check
Does it matter that the plugin runs on Linux?
The record names Linux as the platform. Check the plugin page for other platforms you use.
Sources
Last reviewed: 19 October 2026.
