rapid7CVE-2026-77798

Velociraptor contains a deadlock condition that may be triggered by authenticated users. The issue stems from a lock management bug in the user management module.

Medium6.5CVE-2026-77798 · Published Sep 24, 2026

Affected versions

Package	Affected	Fixed in
Velociraptor Vendor	< 0.77.2	0.77.2

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Severity from: no source yet
Weakness: CWE-833

More rapid7 advisories

All

Date	Advisory	Severity	Fixed in
Sep 24	Velociraptor stores the compiled VQL in the hunt object internally to avoid having to recompile the artifacts for each endpoint in the hunt. CVE-2026-19072Critical9.9fixed in Velociraptor 0.77.2	Critical9.9	Velociraptor 0.77.2
Sep 24	Velociraptor's prefetch library contains an out of bound vulnerability which may cause a crash when parsing certain malformed prefetch files. CVE-2026-77797Low3.6fixed in Velociraptor 0.77.3	Low3.6	Velociraptor 0.77.3
Sep 24	An uncontrolled search path element in InsightVM assessment content in Rapid7 Insight Agent on Windows allows a local, low-privileged user to execute arbitrary code as SYSTEM via a planted executable... CVE-2026-89325High7.8no fix yet	High7.8	No fix yet
Sep 25	Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 suffer from a GraphQL query injection issue in the export-status component (`get_export_status` in `src/export_manager. CVE-2026-97228Low2.7fixed in Platform 0.6.2	Low2.7	Platform 0.6.2
Sep 10	Velociraptor allows for the creation of notebook backups in its default enabled daily backup feature. CVE-2026-19584High7.7fixed in Velociraptor 0.77.2	High7.7	Velociraptor 0.77.2
Sep 10	Velociraptor allows some sensitive artifacts to be gated by additional permissions. For example, the Linux.Sys. CVE-2026-19583Critical9.9fixed in Velociraptor 0.77.2	Critical9.9	Velociraptor 0.77.2

Affected versions

More rapid7 advisories

Critical advisories by email