Skip to content
OpenAdvisories
High WID-SEC-2026-2974 3 CVEs

Rapid7 Velociraptor: Mehrere Schwachstellen

Published Aug 23, 2026 · Updated Sep 9, 2026 · Revision 2 · de-DE

Vendor: Rapid7 Product: Velociraptor Platform: Linux Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Rapid7 Velociraptor ausnutzen, um Dateien zu manipulieren, Sicherheitsmaßnahmen zu umgehen, Code auszuführen oder Berechtigungen zu erweitern.

Product

Rapid7 Velociraptor ist ein Tool zur Endpunkt-Erkennung und -Reaktion (EDR) und zur digitalen Forensik, das eine leistungsstarke Sammlung von Tools zur Überwachung und Analyse von Endpunkten bietet.

Vulnerabilities 3

  • Critical 9.9
    CVE-2026-19583

    Velociraptor Required Permissions bypass by using client monitoring queries

    Velociraptor allows some sensitive artifacts to be gated by additional permissions. For example, the Linux.Sys.BashShell artifact allows arbitrary command execution on endpoints, and so it requires the EXECVE permission to schedule. However, no such check was…

    Rapid7 Velociraptor
  • High 8.9
    CVE-2026-19200

    Velociraptor Analyst overwrites live built-in artifacts through verify()

    The Velociraptor verify() VQL function allows a user to verify an artifact for syntatic and other issues. Due to an implementation fault in this VQL function, the global artifact repository is used which allows callers to overwrite existing artifacts without …

    Rapid7 Velociraptor
  • High 7.7
    CVE-2026-19584

    Velociraptor VQL injection during notebook restore from backup

    Velociraptor allows for the creation of notebook backups in its default enabled daily backup feature. When Velociraptor restores the backup, the notebook cell content is interpolated into a template with no ACL checks. This allows a malicious user with NOTEBO…

    Rapid7 Velociraptor

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2026-75234, EUVD-2026-75233

  2. #1

    Initiale Fassung

References