Vulnerability details
CVE-2026-19583
Rapid7 Velociraptor
Velociraptor Required Permissions bypass by using client monitoring queries
CVSS 3.1
9.9Critical
Official description
Velociraptor allows some sensitive artifacts to be gated by additional permissions. For example, the Linux.Sys.BashShell artifact allows arbitrary command execution on endpoints, and so it requires the EXECVE permission to schedule. However, no such check was implemented for client monitoring artifacts. Additionally there was no requirement that client monitoring artifacts carry the CLIENT_EVENTS type. This allows any user who can schedule client monitoring artifacts to also schedule otherwise restricted artifacts (such as Linux.Sys.BashShell).
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.9Critical | 3.1 | CVEProject cvelistV5 (CNA) (rapid7) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Rapid7 | Velociraptor | v < 0.77.2 | CVEProject cvelistV5 (CNA) |
References and advisories
2
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-09-10
- Last updated
- 2026-09-11
- State
- Published
- Assigner (CNA)
- rapid7
Exploit prediction (EPSS)
0.59%
Probability of exploitation in 30 days
48.8%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-732Incorrect Permission Assignment for Critical Resource