KindaRails2Shell: CVE-2026-66066, Critical Arbitrary File Read and Possible Remote Code Execution in Ruby on Rails
2026-07-31T07:23:39Z•9d169b8b0c23589fd3988f2f473ebebf255c10b85b0827289affe2bd6e03bbd8
CVE-2026-16232CVE-2026-59309CVE-2026-59310CVE-2026-63077CVE-2026-66066Active-StorageCI/CD-securityCheck-Point-SmartConsoleJetBrains-TeamCityMetasploitRuby-on-RailsVMware-vCenterarbitrary-file-readauthentication-bypasscriticalexploited-in-the-wildlibvipsremote-code-executionunauthenticated-exploitationvulnerabilityzero-day
What happened
Rapid7 threat intelligence covering multiple critical vulnerabilities, including unauthenticated remote code execution and authentication bypass in VMware vCenter Server and JetBrains TeamCity, arbitrary file read with possible RCE in Ruby on Rails Active Storage/libvips, and an actively exploited Check Point SmartConsole authentication bypass. The collection also includes Metasploit Framework 6.5 capabilities and security industry commentary.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- rapid7_blog
- Record identifier
- 9d169b8b0c23589fd3988f2f473ebebf255c10b85b0827289affe2bd6e03bbd8
- Enrichment time
- 2026-07-31T07:23:39Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.