by Kastro
Paper/Archive/CVE-2026-19583

CVE-2026-19583

Rapid7 Velociraptor — Velociraptor Required Permissions bypass by using client monitoring queries

EPSS 0.6%CVSS 9.9
critical.is priorityof 100
39
CVSS 9.9 (CNA)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 48.7.487 × 209.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Velociraptor allows some sensitive artifacts to be gated by additional permissions. For example, the Linux.Sys.BashShell artifact allows arbitrary command execution on endpoints, and so it requires the EXECVE permission to schedule. However, no such check was implemented for client monitoring artifacts. Additionally there was no requirement that client monitoring artifacts carry the CLIENT_EVENTS type. This allows any user who can schedule client monitoring artifacts to also schedule otherwise restricted artifacts (such as Linux.Sys.BashShell).

Affected

ProductAffectedFixed inSource
Velociraptor< 0.77.20.77.2CNA

Scores by source

rapid7 (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisorydocs.velociraptor.app/announcements/advisories/cve-2026-19583patchgithub.com/Velocidex/velociraptor/pull/4967