Loading story…
Rapid7 disclosed CVE-2026-5329, an improper input validation flaw in Velociraptor affecting versions prior to 0.76.2. The vulnerability exists in the client monitoring message handler on the Velociraptor server, primarily on Linux, where an authenticated remote attacker can supply a malicious queue name in a crafted monitoring message and write to arbitrary internal server queues. The issue is classified as CWE-20 and carries a CVSS v3.1 vector of AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H.
Rapid7 said the weak validation of client-supplied queue names could let a rogue client inject arbitrary messages into privileged internal queues, creating a path to remote code execution on the server. The company’s advisory indicates that Hosted Velociraptor instances are not affected, and the issue has been addressed in version 0.76.2, making upgrades a priority for self-managed deployments.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
The CVE record for CVE-2026-5329 was newly received by cve@rapid7.com and publicly reflected in downstream CVE tracking on April 9, 2026. The entry classifies the flaw as CWE-20 and includes a CVSS v3.1 vector of AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H.
Rapid7 disclosed CVE-2026-5329, an improper input validation flaw in the Velociraptor client monitoring message handler affecting versions prior to 0.76.2. The issue can let an authenticated remote attacker inject messages into arbitrary internal server queues, potentially leading to remote code execution; Rapid7 also noted Hosted Velociraptor instances are not affected.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcedocs.velociraptor.app
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Rapid7 Velociraptor versions earlier than `0.77.2` were found to contain **15 vulnerabilities**, including **six high-severity flaws** and **one critical issue**, that can let attackers bypass authentication and authorization controls and compromise system data and configurations. The weaknesses span authentication bypass, privilege escalation, security restriction bypass, spoofing, tampering, information disclosure, and arbitrary file write, expanding the attack surface for organizations using the digital forensics and incident response platform. One of the newly disclosed issues, `CVE-2026-18972`, allows an authenticated attacker to spoof another GUI user's identity by sending requests with the `Grpc-Metadata-USER` header, potentially escalating from a low-privileged account to administrator access and enabling account takeover. The flaw is classified as `CWE-290` and carries a high-severity `CVSS:3.1` rating of `AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N`; defenders are advised to upgrade affected deployments to **Velociraptor 0.77.2 or later** in line with the vendor's security guidance.
Aug 11, 2026
Researchers disclosed multiple high-severity vulnerabilities in the open-source **Voyager** admin package for Laravel, warning that flaws in versions **1.8.0 and earlier** can be chained to achieve **remote code execution** and potentially full system compromise. The reported issues include **CVE-2024-55417**, an arbitrary file upload weakness caused by insufficient MIME-type validation, and **CVE-2024-55416**, a reflected **XSS** flaw in the `/admin/compass` component that can help attackers reach code execution in administrative contexts. The disclosures also describe a file path manipulation issue that can enable unauthorized file read and deletion, expanding the impact beyond code execution to broader application and server compromise. Public reporting said no security update was available at the time of notice, and defenders were urged to treat Voyager deployments as exposed, restrict or avoid use of the package until patches are released, and assess Laravel environments for signs of malicious uploads, admin-panel abuse, and tampering with application files.
Jul 24, 2026
A critical **pre-authentication remote code execution** vulnerability has been publicly disclosed in **Vicon Valerus ViconNet Gateway** version `25.200.46.0`. The flaw affects the ASP.NET Web API endpoint `POST /NVR/api/v1/upgrades/multiformat-file-Execute/start`, where attacker-controlled input is concatenated into `cmd.exe /c` and launched through `Process.Start`, allowing arbitrary command execution. Researchers said the endpoint is reachable without authentication and bypasses an authorization gate, enabling remote attackers with network access to ports `8084` or `8444` to execute code as **`NT AUTHORITY\SYSTEM`**. The advisory warns that successful exploitation can result in full compromise of the video management host, including access to recorded footage, camera credentials, and VMS configuration, as well as the ability to alter surveillance operations or destroy evidence. The issue was disclosed by the **0day Rubbish Research Team**, which published both an advisory and a proof of concept, increasing the likelihood of near-term exploitation against exposed systems.
Aug 6, 2026