CVE-2026-8592

CriticalCVSS 9.8/10Last modified Jun 29, 2026

Description

OS Command Injection vulnerability in the process_string action of Rapid7 InsightConnect AWK Plugin on Linux allows remote attackers to execute arbitrary OS commands via the text or expression parameters due to unsafe shell command construction in the processing pipeline.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published
Jun 25, 2026
Last modified
Jun 29, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-859207.0Time-of-check time-of-use (toctou) race condition in Windows BitLocker allows an authorized attacker to elevate privileges locally.CVE-2026-859218.2Double free in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally.CVE-2026-859227.4Weak authentication in Azure Key Vault allows an unauthorized attacker to bypass a security feature over a network.CVE-2026-859258.2Improper restriction of communication channel to intended endpoints in Azure Key Vault allows an authorized attacker to elevate privileges oCVE-2026-859268.1Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code over a network.CVE-2026-859277.8Heap-based buffer overflow in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locallyCVE-2026-859289.8Heap-based buffer overflow in Windows Volume Manager Extension Driver allows an unauthorized attacker to execute code over a network.CVE-2026-85935.3Improper permission enforcement in Checkmk versions 2.5.0 before 2.5.0p9, 2.4.0 before 2.4.0p34, 2.3.0 before 2.3.0p49, and 2.2.0 (EOL) alloCVE-2026-859307.0Use after free in Windows Image Acquisition allows an authorized attacker to elevate privileges locally.CVE-2026-859318.8Heap-based buffer overflow in Windows Distributed File System (DFS) allows an authorized attacker to execute code over a network.CVE-2026-859326.5Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker CVE-2026-859337.8Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.
CVE-2026-8592: Critical severity, CVSS 9.8 | Vulnix