What’s Vulnerable › Vulnerabilities

CVE-2026-18348: Velociraptor NETWORK ACL bypass via upload_azure / upload_sftp / upload_smb VQL plugins

• Severity: medium (CVSS 4.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-11 · updated 2026-10-23
• Weakness: CWE-863

Description

Missing authorization check in the upload_azure, upload_sftp, and upload_smb VQL plugins allows an authenticated analyst-role user can initiate attacker-controlled outbound network connections from the Velociraptor server, bypassing the NETWORK ACL permission boundary. This enables internal network reconnaissance via port oracle and potential data exfiltration to external endpoints.

Affected products

• Rapid7 Velociraptor: before 0.77.2 — fixed in 0.77.2

How to fix

Upgrade to a fixed version: Rapid7 Velociraptor 0.77.2. Check the vendor advisory for mitigations.

References

• http://docs.velociraptor.app/announcements/advisories/cve-2026-18348/
• https://github.com/Velocidex/velociraptor/commit/48824fb51a2bdba832abc281e719ecbed74736df

Get alerted when CVE-2026-18348 or the next vulnerability affects your stack