CVE-2026-19200: rapid7 velociraptor Code Injection
Vulnerability summary
CVE-2026-19200 is a high (CVSS 8.9) Code Injection vulnerability in rapid7 velociraptor. EPSS estimates a 0.23% chance of exploitation in the next 30 days, higher than 12.7% of scored vulnerabilities.
Timeline
- 24-08-2026PublishedVulnerability first disclosed.
- 25-08-2026Last modifiedVulnerability information updated.
Description
The Velociraptor verify() VQL function allows a user to verify an artifact for syntatic and other issues. Due to an implementation fault in this VQL function, the global artifact repository is used which allows callers to overwrite existing artifacts without the required permissions. The attacker need only have the NOTEBOOK_EDIT permission (e.g. an analyst role) to be able to call this function.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST8.9HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L
EPSS trend
Probability
0.23%
Chance of exploitation in the next 30 days
Percentile
13%
Versus all other CVEs
30-day change
0.00 pp
From 0.23% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
- CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Affected systems
Rapid71 product
- velociraptor< 0.77.2
1 vendor · 1 product