# Rapid7 vulnerabilities Source: https://junglewise.ai/threats/vendors/rapid7 Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/rapid7.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 29 vulnerabilities in Rapid7: 0 in the last 7 days and 8 in the last 90 days, 3 of them critical and 0 exploited in the wild. The most recent, CVE-2026-121139, was published on 5 November 2026. 5 vulnerabilities in the last four weeks, up 150% on the four before (2). 1 critical against 1. 4 technologies have a page of their own. ## Counts - Last 7 days: 0 - Last 30 days: 3 - Last 90 days: 8 - All time: 29 (3 critical, 0 exploited in the wild) ## About Rapid7 Rapid7 is a cybersecurity company that provides vulnerability management, detection and response, and security orchestration tools. ## Latest Rapid7 vulnerabilities - [CVE-2026-121139: Rapid7 Metasploit msf-ws missing authentication in bootstrap](https://junglewise.ai/threats/cve-2026-121139-the-rapid7-metasploit-msf-ws-suffers-from-a-missing) (info, published 5 Nov 2026) - [CVE-2026-115805: Rapid7 Insight Agent privilege escalation in filesystem path handling](https://junglewise.ai/threats/cve-2026-115805-improper-handling-of-local-filesystem-paths-in-rapid7-insight) (high, CVSS 7.8, published 29 Oct 2026) - [CVE-2026-109682: Metasploit Framework HTTP redirect server-side request forgery](https://junglewise.ai/threats/cve-2026-109682-metasploit-framework-versions-before-6-5-7-allow-http-requests) (medium, CVSS 4.7, published 21 Oct 2026) - [CVE-2026-87689: Metasploit Framework authentication bypass in credential REST API](https://junglewise.ai/threats/cve-2026-87689-the-metasploit-framework-web-service-rest-api-msf-ws-exposes-the) (critical, CVSS 9.8, published 13 Oct 2026) - [CVE-2026-87690: Metasploit Framework relative path traversal in iOS image gather](https://junglewise.ai/threats/cve-2026-87690-the-metasploit-framework-post-module-post-apple-ios-gather-ios) (high, CVSS 8.8, published 12 Oct 2026) - [CVE-2026-89325: Rapid7 Insight Agent uncontrolled search path element on Windows](https://junglewise.ai/threats/cve-2026-89325-an-uncontrolled-search-path-element-in-insightvm-assessment) (high, CVSS 7.8, published 24 Sep 2026) - [CVE-2026-19072: Velociraptor privilege escalation via hunt compiled VQL](https://junglewise.ai/threats/cve-2026-19072-velociraptor-stores-the-compiled-vql-in-the-hunt-object) (critical, CVSS 9.9, published 24 Sep 2026) - [CVE-2026-16895: Rapid7 Metasploit Framework JSON-RPC auth bypass](https://junglewise.ai/threats/cve-2026-16895-rapid7-metasploit-framework-json-rpc-auth-bypass) (info, published 27 Aug 2026) - [CVE-2026-14172: Rapid7 InsightVM and Insight Agent privilege escalation via unvalidated file execution](https://junglewise.ai/threats/cve-2026-14172-rapid7-insightvm-and-insight-agent-privilege-escalation-via) (high, CVSS 7.8, published 24 Jul 2026) - [CVE-2026-8661: Rapid7 InsightConnect Markdown Plugin XSS and SSRF in markdown_to_pdf](https://junglewise.ai/threats/cve-2026-8661-rapid7-insightconnect-markdown-plugin-xss-and-ssrf-in-markdown-to) (medium, CVSS 4.8, published 26 Jun 2026) - [CVE-2026-8662: Rapid7 InsightConnect Compression Plugin path traversal in create_archive](https://junglewise.ai/threats/cve-2026-8662-rapid7-insightconnect-compression-plugin-path-traversal-in-create) (low, CVSS 3.3, published 25 Jun 2026) - [CVE-2026-8658: Rapid7 InsightConnect Tcpdump Plugin OS command injection](https://junglewise.ai/threats/cve-2026-8658-rapid7-insightconnect-tcpdump-plugin-os-command-injection) (medium, CVSS 6, published 25 Jun 2026) - [CVE-2026-8666: Rapid7 InsightConnect Traceroute Plugin OS command injection](https://junglewise.ai/threats/cve-2026-8666-rapid7-insightconnect-traceroute-plugin-os-command-injection) (high, CVSS 7.7, published 25 Jun 2026) - [CVE-2026-8665: Rapid7 InsightConnect Translate Plugin OS command injection in TR action](https://junglewise.ai/threats/cve-2026-8665-rapid7-insightconnect-translate-plugin-os-command-injection-in-tr) (high, CVSS 7.7, published 25 Jun 2026) - [CVE-2026-8664: Rapid7 InsightConnect Finger Plugin OS command injection](https://junglewise.ai/threats/cve-2026-8664-rapid7-insightconnect-finger-plugin-os-command-injection) (medium, CVSS 6, published 25 Jun 2026) - [CVE-2026-8660: Rapid7 InsightConnect Ping Plugin OS command injection in ping action](https://junglewise.ai/threats/cve-2026-8660-rapid7-insightconnect-ping-plugin-os-command-injection-in-ping) (high, CVSS 7.7, published 25 Jun 2026) - [CVE-2026-8592: Rapid7 InsightConnect AWK Plugin OS command injection in process_string](https://junglewise.ai/threats/cve-2026-8592-rapid7-insightconnect-awk-plugin-os-command-injection-in-process) (high, CVSS 7.7, published 25 Jun 2026) - [CVE-2026-9155: Rapid7 InsightConnect Sed Plugin OS command injection](https://junglewise.ai/threats/cve-2026-9155-rapid7-insightconnect-sed-plugin-os-command-injection) (high, CVSS 8.8, published 25 Jun 2026) - [CVE-2026-9154: Rapid7 InsightConnect Sed Plugin arbitrary file write in expression parameter](https://junglewise.ai/threats/cve-2026-9154-rapid7-insightconnect-sed-plugin-arbitrary-file-write-in) (high, CVSS 7.1, published 25 Jun 2026) - [CVE-2026-9153: Rapid7 InsightConnect Sed Plugin arbitrary file read via expression parameter](https://junglewise.ai/threats/cve-2026-9153-rapid7-insightconnect-sed-plugin-arbitrary-file-read-via) (medium, CVSS 6.5, published 25 Jun 2026) - [CVE-2026-8663: Rapid7 InsightConnect RPM Plugin OS command injection](https://junglewise.ai/threats/cve-2026-8663-rapid7-insightconnect-rpm-plugin-os-command-injection) (medium, CVSS 6, published 25 Jun 2026) - [CVE-2026-8659: Rapid7 InsightConnect SQLmap Plugin OS command injection](https://junglewise.ai/threats/cve-2026-8659-rapid7-insightconnect-sqlmap-plugin-os-command-injection) (medium, CVSS 6, published 25 Jun 2026) - [CVE-2026-7373: Rapid7 Metasploit Pro local privilege escalation in PostgreSQL service](https://junglewise.ai/threats/cve-2026-7373-rapid7-metasploit-pro-local-privilege-escalation-in-postgresql) (info, CVSS 8.5, published 15 May 2026) - [CVE-2026-6482: The Rapid7 Insight Agent (versions > 4.1.0.2) is vulnerable to a local privilege escalation attack that allows users…](https://junglewise.ai/threats/cve-2026-6482-the-rapid7-insight-agent-versions-4-1-0-2-is-vulnerable-to-a-local) (high, CVSS 7.8, published 17 Apr 2026) - [CVE-2026-6290: Velociraptor vulnerability in the query() plugin which allows access to all orgs with the user's current ACL token](https://junglewise.ai/threats/cve-2026-6290-velociraptor-vulnerability-in-the-query-plugin-which-allows-access) (critical, CVSS 9.1, published 15 Apr 2026) ## Most severe Rapid7 vulnerabilities - [CVE-2026-19072: Velociraptor privilege escalation via hunt compiled VQL](https://junglewise.ai/threats/cve-2026-19072-velociraptor-stores-the-compiled-vql-in-the-hunt-object) (critical, CVSS 9.9, published 24 Sep 2026) - [CVE-2026-87689: Metasploit Framework authentication bypass in credential REST API](https://junglewise.ai/threats/cve-2026-87689-the-metasploit-framework-web-service-rest-api-msf-ws-exposes-the) (critical, CVSS 9.8, published 13 Oct 2026) - [CVE-2026-6290: Velociraptor vulnerability in the query() plugin which allows access to all orgs with the user's current ACL token](https://junglewise.ai/threats/cve-2026-6290-velociraptor-vulnerability-in-the-query-plugin-which-allows-access) (critical, CVSS 9.1, published 15 Apr 2026) - [CVE-2026-87690: Metasploit Framework relative path traversal in iOS image gather](https://junglewise.ai/threats/cve-2026-87690-the-metasploit-framework-post-module-post-apple-ios-gather-ios) (high, CVSS 8.8, published 12 Oct 2026) - [CVE-2026-9155: Rapid7 InsightConnect Sed Plugin OS command injection](https://junglewise.ai/threats/cve-2026-9155-rapid7-insightconnect-sed-plugin-os-command-injection) (high, CVSS 8.8, published 25 Jun 2026) - [CVE-2026-5329: Rapid7 Velociraptor versions prior to 0.76.2 contain an improper input validation vulnerability in the client…](https://junglewise.ai/threats/cve-2026-5329-rapid7-velociraptor-versions-prior-to-0-76-2-contain-an-improper) (high, CVSS 8.5, published 9 Apr 2026) - [CVE-2026-6482: The Rapid7 Insight Agent (versions > 4.1.0.2) is vulnerable to a local privilege escalation attack that allows users…](https://junglewise.ai/threats/cve-2026-6482-the-rapid7-insight-agent-versions-4-1-0-2-is-vulnerable-to-a-local) (high, CVSS 7.8, published 17 Apr 2026) - [CVE-2026-89325: Rapid7 Insight Agent uncontrolled search path element on Windows](https://junglewise.ai/threats/cve-2026-89325-an-uncontrolled-search-path-element-in-insightvm-assessment) (high, CVSS 7.8, published 24 Sep 2026) - [CVE-2026-115805: Rapid7 Insight Agent privilege escalation in filesystem path handling](https://junglewise.ai/threats/cve-2026-115805-improper-handling-of-local-filesystem-paths-in-rapid7-insight) (high, CVSS 7.8, published 29 Oct 2026) - [CVE-2026-14172: Rapid7 InsightVM and Insight Agent privilege escalation via unvalidated file execution](https://junglewise.ai/threats/cve-2026-14172-rapid7-insightvm-and-insight-agent-privilege-escalation-via) (high, CVSS 7.8, published 24 Jul 2026) ## Vulnerabilities per week 5 vulnerabilities in the last four weeks, up 150% on the four before (2). 1 critical against 1. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 1 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 2 | 1 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 2 | 1 | 0 | | 19 Oct 2026 | 1 | 0 | 0 | | 26 Oct 2026 | 1 | 0 | 0 | | 2 Nov 2026 | 1 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Rapid7 technologies - [Rapid7 Insight Agent](https://junglewise.ai/threats/technologies/insight-agent): 6 vulnerabilities - [Rapid7 Metasploit Framework](https://junglewise.ai/threats/technologies/metasploit-framework): 4 vulnerabilities - [Rapid7 Velociraptor](https://junglewise.ai/threats/technologies/rapid7-velociraptor): 4 vulnerabilities - [Rapid7 InsightConnect Sed Plugin](https://junglewise.ai/threats/technologies/insightconnect-sed-plugin): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Rapid7 vulnerabilities", https://junglewise.ai/threats/vendors/rapid7, 13 November 2026.