Loading story…
Rapid7 Velociraptor versions earlier than 0.77.2 were found to contain 15 vulnerabilities, including six high-severity flaws and one critical issue, that can let attackers bypass authentication and authorization controls and compromise system data and configurations. The weaknesses span authentication bypass, privilege escalation, security restriction bypass, spoofing, tampering, information disclosure, and arbitrary file write, expanding the attack surface for organizations using the digital forensics and incident response platform.
One of the newly disclosed issues, CVE-2026-18972, allows an authenticated attacker to spoof another GUI user's identity by sending requests with the Grpc-Metadata-USER header, potentially escalating from a low-privileged account to administrator access and enabling account takeover. The flaw is classified as CWE-290 and carries a high-severity CVSS:3.1 rating of AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N; defenders are advised to upgrade affected deployments to Velociraptor 0.77.2 or later in line with the vendor's security guidance.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-18860 was newly received by cve@rapid7.com as a high-severity authorization flaw in Rapid7 Velociraptor versions earlier than 0.77.2. The issue lets a child-org administrator abuse incorrect ORG_ADMIN permission checks during org deletion to delete other orgs without ROOT org administrator privileges.
CVE-2026-18972 was newly received by cve@rapid7.com as an authenticated identity-spoofing flaw in Velociraptor versions earlier than 0.77.2. The issue allows a low-privileged authenticated attacker to spoof another GUI user via the "Grpc-Metadata-USER" header and potentially take over an administrator account.
A notice reported 15 new vulnerabilities in Rapid7 Velociraptor, including six high-severity issues and one critical issue, affecting versions earlier than 0.77.2. The recommended mitigation was to update to the fixed version in line with the vendor's security bulletins.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcecyber.gc.ca
Open sourceacn.gov.it
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Rapid7 disclosed **CVE-2026-5329**, an improper input validation flaw in **Velociraptor** affecting versions prior to `0.76.2`. The vulnerability exists in the client monitoring message handler on the Velociraptor server, primarily on Linux, where an authenticated remote attacker can supply a malicious queue name in a crafted monitoring message and write to arbitrary internal server queues. The issue is classified as **CWE-20** and carries a **CVSS v3.1** vector of `AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H`. Rapid7 said the weak validation of client-supplied queue names could let a rogue client inject arbitrary messages into privileged internal queues, creating a path to **remote code execution** on the server. The company’s advisory indicates that **Hosted Velociraptor** instances are **not affected**, and the issue has been addressed in version `0.76.2`, making upgrades a priority for self-managed deployments.
Jun 29, 2026
BeyondTrust disclosed multiple vulnerabilities affecting **Remote Support** and **Privileged Remote Access** appliances, including two critical pre-authentication authentication-bypass flaws tracked as `CVE-2026-40138` and `CVE-2026-40139`. Both issues carry **CVSS 9.2** ratings and can allow remote attackers to gain unauthorized access, including access to elevated-privilege accounts, when a specific authentication configuration is enabled. A separate pre-authentication flaw, `CVE-2026-40140`, was rated **CVSS 8.7** and can be exploited remotely to cause a denial-of-service condition in the network communication subsystem. BeyondTrust also addressed `CVE-2026-40141`, a **CVSS 8.5** vulnerability in a web application component that could let an authenticated low-privilege user access resources or data outside their intended authorization scope. The affected products are **Remote Support 25.3.2 and earlier** and **Privileged Remote Access 25.3.2 and earlier**. The Canadian Centre for Cyber Security urged administrators to review BeyondTrust’s advisory, apply vendor updates, disable the affected authentication configuration where possible, and review access controls and permissions.
Jul 9, 2026
RATOC Systems' **RAID Monitoring Manager for Windows** is affected by two high-severity installer vulnerabilities that can let attackers execute arbitrary code with elevated privileges. **`CVE-2026-32680`** is a local privilege escalation flaw tied to custom installation paths: when the software is installed outside the default directory, insecure ACLs can leave the target folder writable by non-administrative users, creating a path to **SYSTEM-level** code execution. The issue is classified as **`CWE-276`** and carries high impact across confidentiality, integrity, and availability. A second flaw, **`CVE-2026-28760`**, affects the same installer through improper DLL loading. The installer searches the current directory for certain DLLs, so an attacker who places a crafted DLL next to the installer and convinces a user to run it can achieve arbitrary code execution with **administrator privileges**. That issue is classified as **`CWE-427`**, and both vulnerabilities were published through JPCERT/JVN-linked advisories and RATOC references as high-severity Windows privilege-escalation risks.
Jun 29, 2026