KindaRails2Shell: CVE-2026-66066, Critical Arbitrary File Read and Possible Remote Code Execution in Ruby on Rails
2026-07-30T19:23:38Z•3a89247f5fc957d353a5ffce60474f33ea4562c950e03f9298bfe74939d92346
CVE-2026-16232CVE-2026-59309CVE-2026-59310CVE-2026-63077CVE-2026-66066Active-StorageCI-CD-securityCheck-Point-SmartConsoleJetBrains-TeamCityMetasploitRuby-on-RailsVMware-vCenterarbitrary-file-readauthentication-bypasscritical-vulnerabilityexploited-in-the-wildlibvipsremote-code-executionunauthenticated-exploitationzero-day
What happened
Rapid7 reports several critical vulnerabilities disclosed in late July 2026, including unauthenticated remote code execution or authentication bypass in Ruby on Rails Active Storage/libvips (CVE-2026-66066), VMware vCenter Server (CVE-2026-59309 and CVE-2026-59310), JetBrains TeamCity On-Premises (CVE-2026-63077), and Check Point SmartConsole (CVE-2026-16232, reportedly exploited in the wild). The feed also includes Metasploit Framework 6.5 capabilities and non-vulnerability MDR and AI security commentary.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- rapid7_blog
- Record identifier
- 3a89247f5fc957d353a5ffce60474f33ea4562c950e03f9298bfe74939d92346
- Enrichment time
- 2026-07-30T19:23:38Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.