VulnerabilityAwaiting Analysis

CVE-2026-19583

Velociraptor allows some sensitive artifacts to be gated by additional permissions.

CRITICAL 9.9EPSS 0.60%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.60%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Velociraptor allows some sensitive artifacts to be gated by additional permissions. For example, the Linux.Sys.BashShell artifact allows arbitrary command execution on endpoints, and so it requires the EXECVE permission to schedule. However, no such check was implemented for client monitoring artifacts. Additionally there was no requirement that client monitoring artifacts carry the CLIENT_EVENTS type. This allows any user who can schedule client monitoring artifacts to also schedule otherwise restricted artifacts (such as Linux.Sys.BashShell).

CVSS 3.1: 9.9 CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
EPSS: 0.60% probability · 47th percentile
CISA KEV: Not listed
Weakness: CWE-732
Source: cve@rapid7.com

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.