{"schema_version":1,"title":"Rapid7 vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 20 vulnerabilities in Rapid7: 2 in the last 7 days and 4 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-89325, was published on 24 September 2026. 2 technologies have a page of their own.","url":"https://junglewise.ai/threats/vendors/rapid7","json_url":"https://junglewise.ai/threats/vendors/rapid7.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/rapid7","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","counts":{"high":8,"all_time":20,"critical":1,"exploited":0,"last_7_days":2,"last_30_days":2,"last_90_days":4,"last_365_days":20},"latest":[{"cve":"CVE-2026-89325","cvss":7.8,"epss":0.0013,"slug":"cve-2026-89325-an-uncontrolled-search-path-element-in-insightvm-assessment","title":"Rapid7 Insight Agent uncontrolled search path element on Windows","severity":"high","exploited":false,"published_at":"2026-09-24T19:17:19.58+00:00","url":"https://junglewise.ai/threats/cve-2026-89325-an-uncontrolled-search-path-element-in-insightvm-assessment"},{"cve":"CVE-2026-19072","cvss":9.9,"epss":0.004,"slug":"cve-2026-19072-velociraptor-stores-the-compiled-vql-in-the-hunt-object","title":"Velociraptor privilege escalation via hunt compiled VQL","severity":"critical","exploited":false,"published_at":"2026-09-24T13:17:09.5+00:00","url":"https://junglewise.ai/threats/cve-2026-19072-velociraptor-stores-the-compiled-vql-in-the-hunt-object"},{"cve":"CVE-2026-16895","epss":0.0016,"slug":"cve-2026-16895-rapid7-metasploit-framework-json-rpc-auth-bypass","title":"Rapid7 Metasploit Framework JSON-RPC auth bypass","severity":"info","exploited":false,"published_at":"2026-08-27T04:16:41.53+00:00","url":"https://junglewise.ai/threats/cve-2026-16895-rapid7-metasploit-framework-json-rpc-auth-bypass"},{"cve":"CVE-2026-14172","cvss":7.8,"slug":"cve-2026-14172-rapid7-insightvm-and-insight-agent-privilege-escalation-via","title":"Rapid7 InsightVM and Insight Agent privilege escalation via unvalidated file execution","severity":"high","exploited":false,"published_at":"2026-07-24T07:16:32.977+00:00","url":"https://junglewise.ai/threats/cve-2026-14172-rapid7-insightvm-and-insight-agent-privilege-escalation-via"},{"cve":"CVE-2026-8661","cvss":4.8,"slug":"cve-2026-8661-rapid7-insightconnect-markdown-plugin-xss-and-ssrf-in-markdown-to","title":"Rapid7 InsightConnect Markdown Plugin XSS and SSRF in markdown_to_pdf","severity":"medium","exploited":false,"published_at":"2026-06-26T02:16:54.64+00:00","url":"https://junglewise.ai/threats/cve-2026-8661-rapid7-insightconnect-markdown-plugin-xss-and-ssrf-in-markdown-to"},{"cve":"CVE-2026-8662","cvss":3.3,"slug":"cve-2026-8662-rapid7-insightconnect-compression-plugin-path-traversal-in-create","title":"Rapid7 InsightConnect Compression Plugin path traversal in create_archive","severity":"low","exploited":false,"published_at":"2026-06-25T03:16:44.113+00:00","url":"https://junglewise.ai/threats/cve-2026-8662-rapid7-insightconnect-compression-plugin-path-traversal-in-create"},{"cve":"CVE-2026-8658","cvss":6,"slug":"cve-2026-8658-rapid7-insightconnect-tcpdump-plugin-os-command-injection","title":"Rapid7 InsightConnect Tcpdump Plugin OS command injection","severity":"medium","exploited":false,"published_at":"2026-06-25T03:16:44+00:00","url":"https://junglewise.ai/threats/cve-2026-8658-rapid7-insightconnect-tcpdump-plugin-os-command-injection"},{"cve":"CVE-2026-8666","cvss":7.7,"slug":"cve-2026-8666-rapid7-insightconnect-traceroute-plugin-os-command-injection","title":"Rapid7 InsightConnect Traceroute Plugin OS command injection","severity":"high","exploited":false,"published_at":"2026-06-25T02:16:35.567+00:00","url":"https://junglewise.ai/threats/cve-2026-8666-rapid7-insightconnect-traceroute-plugin-os-command-injection"},{"cve":"CVE-2026-8665","cvss":7.7,"slug":"cve-2026-8665-rapid7-insightconnect-translate-plugin-os-command-injection-in-tr","title":"Rapid7 InsightConnect Translate Plugin OS command injection in TR action","severity":"high","exploited":false,"published_at":"2026-06-25T02:16:35.34+00:00","url":"https://junglewise.ai/threats/cve-2026-8665-rapid7-insightconnect-translate-plugin-os-command-injection-in-tr"},{"cve":"CVE-2026-8664","cvss":6,"slug":"cve-2026-8664-rapid7-insightconnect-finger-plugin-os-command-injection","title":"Rapid7 InsightConnect Finger Plugin OS command injection","severity":"medium","exploited":false,"published_at":"2026-06-25T02:16:35.227+00:00","url":"https://junglewise.ai/threats/cve-2026-8664-rapid7-insightconnect-finger-plugin-os-command-injection"},{"cve":"CVE-2026-8660","cvss":7.7,"slug":"cve-2026-8660-rapid7-insightconnect-ping-plugin-os-command-injection-in-ping","title":"Rapid7 InsightConnect Ping Plugin OS command injection in ping action","severity":"high","exploited":false,"published_at":"2026-06-25T02:16:35.11+00:00","url":"https://junglewise.ai/threats/cve-2026-8660-rapid7-insightconnect-ping-plugin-os-command-injection-in-ping"},{"cve":"CVE-2026-8592","cvss":7.7,"slug":"cve-2026-8592-rapid7-insightconnect-awk-plugin-os-command-injection-in-process","title":"Rapid7 InsightConnect AWK Plugin OS command injection in process_string","severity":"high","exploited":false,"published_at":"2026-06-25T02:16:34.99+00:00","url":"https://junglewise.ai/threats/cve-2026-8592-rapid7-insightconnect-awk-plugin-os-command-injection-in-process"},{"cve":"CVE-2026-9155","cvss":8.8,"slug":"cve-2026-9155-rapid7-insightconnect-sed-plugin-os-command-injection","title":"Rapid7 InsightConnect Sed Plugin OS command injection","severity":"high","exploited":false,"published_at":"2026-06-25T01:16:27.787+00:00","url":"https://junglewise.ai/threats/cve-2026-9155-rapid7-insightconnect-sed-plugin-os-command-injection"},{"cve":"CVE-2026-9154","cvss":7.1,"slug":"cve-2026-9154-rapid7-insightconnect-sed-plugin-arbitrary-file-write-in","title":"Rapid7 InsightConnect Sed Plugin arbitrary file write in expression parameter","severity":"high","exploited":false,"published_at":"2026-06-25T01:16:27.673+00:00","url":"https://junglewise.ai/threats/cve-2026-9154-rapid7-insightconnect-sed-plugin-arbitrary-file-write-in"},{"cve":"CVE-2026-9153","cvss":6.5,"slug":"cve-2026-9153-rapid7-insightconnect-sed-plugin-arbitrary-file-read-via","title":"Rapid7 InsightConnect Sed Plugin arbitrary file read via expression parameter","severity":"medium","exploited":false,"published_at":"2026-06-25T01:16:27.56+00:00","url":"https://junglewise.ai/threats/cve-2026-9153-rapid7-insightconnect-sed-plugin-arbitrary-file-read-via"},{"cve":"CVE-2026-8663","cvss":6,"slug":"cve-2026-8663-rapid7-insightconnect-rpm-plugin-os-command-injection","title":"Rapid7 InsightConnect RPM Plugin OS command injection","severity":"medium","exploited":false,"published_at":"2026-06-25T00:17:48.07+00:00","url":"https://junglewise.ai/threats/cve-2026-8663-rapid7-insightconnect-rpm-plugin-os-command-injection"},{"cve":"CVE-2026-8659","cvss":6,"slug":"cve-2026-8659-rapid7-insightconnect-sqlmap-plugin-os-command-injection","title":"Rapid7 InsightConnect SQLmap Plugin OS command injection","severity":"medium","exploited":false,"published_at":"2026-06-25T00:17:47.937+00:00","url":"https://junglewise.ai/threats/cve-2026-8659-rapid7-insightconnect-sqlmap-plugin-os-command-injection"},{"cve":"CVE-2026-7373","cvss":8.5,"epss":0.0001,"slug":"cve-2026-7373-rapid7-metasploit-pro-local-privilege-escalation-in-postgresql","title":"Rapid7 Metasploit Pro local privilege escalation in PostgreSQL service","severity":"info","exploited":false,"published_at":"2026-05-15T03:16:23.27+00:00","url":"https://junglewise.ai/threats/cve-2026-7373-rapid7-metasploit-pro-local-privilege-escalation-in-postgresql"},{"cve":"CVE-2026-4482","cvss":5.5,"epss":0.0001,"slug":"cve-2026-4482-rapid7-insight-agent-incorrect-permission-assignment-in-ssl","title":"Rapid7 Insight Agent incorrect permission assignment in SSL bootstrap folder","severity":"medium","exploited":false,"published_at":"2026-04-10T05:16:04.587+00:00","url":"https://junglewise.ai/threats/cve-2026-4482-rapid7-insight-agent-incorrect-permission-assignment-in-ssl"},{"cve":"CVE-2026-4837","cvss":6.6,"epss":0.0033,"slug":"cve-2026-4837-rapid7-insight-agent-eval-injection-in-linux-beaconing-logic","title":"Rapid7 Insight Agent eval injection in Linux beaconing logic","severity":"medium","exploited":false,"published_at":"2026-04-08T17:21:24.603+00:00","url":"https://junglewise.ai/threats/cve-2026-4837-rapid7-insight-agent-eval-injection-in-linux-beaconing-logic"}],"vendor":{"hub":true,"name":"Rapid7","slug":"rapid7","homepage":"https://www.rapid7.com/","description":"Rapid7 is a cybersecurity company that provides vulnerability management, detection and response, and security orchestration tools.","url":"https://junglewise.ai/threats/vendors/rapid7"},"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":1,"exploited":0,"vulnerabilities":2}],"most_severe":[{"cve":"CVE-2026-19072","cvss":9.9,"epss":0.004,"slug":"cve-2026-19072-velociraptor-stores-the-compiled-vql-in-the-hunt-object","title":"Velociraptor privilege escalation via hunt compiled VQL","severity":"critical","exploited":false,"published_at":"2026-09-24T13:17:09.5+00:00","url":"https://junglewise.ai/threats/cve-2026-19072-velociraptor-stores-the-compiled-vql-in-the-hunt-object"},{"cve":"CVE-2026-9155","cvss":8.8,"slug":"cve-2026-9155-rapid7-insightconnect-sed-plugin-os-command-injection","title":"Rapid7 InsightConnect Sed Plugin OS command injection","severity":"high","exploited":false,"published_at":"2026-06-25T01:16:27.787+00:00","url":"https://junglewise.ai/threats/cve-2026-9155-rapid7-insightconnect-sed-plugin-os-command-injection"},{"cve":"CVE-2026-89325","cvss":7.8,"epss":0.0013,"slug":"cve-2026-89325-an-uncontrolled-search-path-element-in-insightvm-assessment","title":"Rapid7 Insight Agent uncontrolled search path element on Windows","severity":"high","exploited":false,"published_at":"2026-09-24T19:17:19.58+00:00","url":"https://junglewise.ai/threats/cve-2026-89325-an-uncontrolled-search-path-element-in-insightvm-assessment"},{"cve":"CVE-2026-14172","cvss":7.8,"slug":"cve-2026-14172-rapid7-insightvm-and-insight-agent-privilege-escalation-via","title":"Rapid7 InsightVM and Insight Agent privilege escalation via unvalidated file execution","severity":"high","exploited":false,"published_at":"2026-07-24T07:16:32.977+00:00","url":"https://junglewise.ai/threats/cve-2026-14172-rapid7-insightvm-and-insight-agent-privilege-escalation-via"},{"cve":"CVE-2026-8666","cvss":7.7,"slug":"cve-2026-8666-rapid7-insightconnect-traceroute-plugin-os-command-injection","title":"Rapid7 InsightConnect Traceroute Plugin OS command injection","severity":"high","exploited":false,"published_at":"2026-06-25T02:16:35.567+00:00","url":"https://junglewise.ai/threats/cve-2026-8666-rapid7-insightconnect-traceroute-plugin-os-command-injection"},{"cve":"CVE-2026-8665","cvss":7.7,"slug":"cve-2026-8665-rapid7-insightconnect-translate-plugin-os-command-injection-in-tr","title":"Rapid7 InsightConnect Translate Plugin OS command injection in TR action","severity":"high","exploited":false,"published_at":"2026-06-25T02:16:35.34+00:00","url":"https://junglewise.ai/threats/cve-2026-8665-rapid7-insightconnect-translate-plugin-os-command-injection-in-tr"},{"cve":"CVE-2026-8660","cvss":7.7,"slug":"cve-2026-8660-rapid7-insightconnect-ping-plugin-os-command-injection-in-ping","title":"Rapid7 InsightConnect Ping Plugin OS command injection in ping action","severity":"high","exploited":false,"published_at":"2026-06-25T02:16:35.11+00:00","url":"https://junglewise.ai/threats/cve-2026-8660-rapid7-insightconnect-ping-plugin-os-command-injection-in-ping"},{"cve":"CVE-2026-8592","cvss":7.7,"slug":"cve-2026-8592-rapid7-insightconnect-awk-plugin-os-command-injection-in-process","title":"Rapid7 InsightConnect AWK Plugin OS command injection in process_string","severity":"high","exploited":false,"published_at":"2026-06-25T02:16:34.99+00:00","url":"https://junglewise.ai/threats/cve-2026-8592-rapid7-insightconnect-awk-plugin-os-command-injection-in-process"},{"cve":"CVE-2026-9154","cvss":7.1,"slug":"cve-2026-9154-rapid7-insightconnect-sed-plugin-arbitrary-file-write-in","title":"Rapid7 InsightConnect Sed Plugin arbitrary file write in expression parameter","severity":"high","exploited":false,"published_at":"2026-06-25T01:16:27.673+00:00","url":"https://junglewise.ai/threats/cve-2026-9154-rapid7-insightconnect-sed-plugin-arbitrary-file-write-in"},{"cve":"CVE-2026-4837","cvss":6.6,"epss":0.0033,"slug":"cve-2026-4837-rapid7-insight-agent-eval-injection-in-linux-beaconing-logic","title":"Rapid7 Insight Agent eval injection in Linux beaconing logic","severity":"medium","exploited":false,"published_at":"2026-04-08T17:21:24.603+00:00","url":"https://junglewise.ai/threats/cve-2026-4837-rapid7-insight-agent-eval-injection-in-linux-beaconing-logic"}],"generated_at":"2026-09-26T11:07:00.153785+00:00","technologies":[{"name":"Rapid7 Insight Agent","slug":"insight-agent","vulnerabilities":3,"url":"https://junglewise.ai/threats/technologies/insight-agent"},{"name":"Rapid7 InsightConnect Sed Plugin","slug":"insightconnect-sed-plugin","vulnerabilities":3,"url":"https://junglewise.ai/threats/technologies/insightconnect-sed-plugin"}]}