Vulnerability · Published Aug 11, 2026 · Assigned by rapid7

CVE-2026-18348Velociraptor NETWORK ACL bypass via upload_azure / upload_sftp / upload_smb VQL plugins

Medium 4.1

In plain English

A medium-severity incorrect authorization in Velociraptor from Rapid7. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).

Severity (CVSS 3.1)4.1Medium

Exploit odds (30 days)0.3%top 72.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Missing authorization check in the upload_azure, upload_sftp, and upload_smb VQL plugins allows an authenticated analyst-role user can initiate attacker-controlled outbound network connections from the Velociraptor server, bypassing the NETWORK ACL permission boundary. This enables internal network reconnaissance via port oracle and potential data exfiltration to external endpoints.

Affected products (as reported)

Vendor	Product	Versions
Rapid7	Velociraptor	0 – before 0.77.2

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

In plain English

Official description

Affected products (as reported)

References