CVE-2026-8592

CriticalCVSS 9.8/10Last modified Oct 25, 2026

Description

OS Command Injection vulnerability in the process_string action of Rapid7 InsightConnect AWK Plugin on Linux allows remote attackers to execute arbitrary OS commands via the text or expression parameters due to unsafe shell command construction in the processing pipeline.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

VendorProductVersions
Rapid7InsightConnect AWK Plugin< 1.2.2

References

Timeline

Published
Jun 25, 2026
Last modified
Oct 25, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-859207.0Time-of-check time-of-use (toctou) race condition in Windows BitLocker allows an authorized attacker to elevate privileges locally.CVE-2026-859218.2Double free in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally.CVE-2026-859227.4Weak authentication in Azure Key Vault allows an unauthorized attacker to bypass a security feature over a network.CVE-2026-859238.8Authorization bypass through user-controlled key in Azure DevOps Server allows an authorized attacker to elevate privileges over a network.CVE-2026-859258.2Improper restriction of communication channel to intended endpoints in Azure Key Vault allows an authorized attacker to elevate privileges oCVE-2026-859268.1Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code over a network.CVE-2026-859277.8Heap-based buffer overflow in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locallyCVE-2026-859289.8Heap-based buffer overflow in Windows Volume Manager Extension Driver allows an unauthorized attacker to execute code over a network.CVE-2026-859297.8Incorrect permission assignment for critical resource in Windows Brokering File System allows an authorized attacker to elevate privileges lCVE-2026-85935.3Improper permission enforcement in Checkmk versions 2.5.0 before 2.5.0p9, 2.4.0 before 2.4.0p34, 2.3.0 before 2.3.0p49, and 2.2.0 (EOL) alloCVE-2026-859307.0Use after free in Windows Image Acquisition allows an authorized attacker to elevate privileges locally.CVE-2026-859318.8Heap-based buffer overflow in Windows Distributed File System (DFS) allows an authorized attacker to execute code over a network.
CVE-2026-8592: Critical severity, CVSS 9.8 | Vulnix