CVE-2026-77798
📛 CVE Title
Velociraptor Authenticated Denial of Service
Description
Velociraptor contains a deadlock condition that may be triggered by authenticated users. The issue stems from a lock management bug in the user management module.
Overview
- State
- PUBLISHED
- Assigner (CNA)
- rapid7
- CVSS severity
- MEDIUM
- CVSS score
- 6.5 / 10
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H- Effective score
- 6.5 / 10 MEDIUM source: CNA overview
- CWE(s)
-
CWE-833 - Reserved
- 2026-08-21
- Published
- 2026-09-24 13:50 UTC
- Last updated
- 2026-09-24 14:48 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/77xxx/CVE-2026-77798.json
NVD triage scoring NVD CVE 2.0
Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.
- NVD published
- 2026-09-24 14:18:17 UTC
- NVD last modified
- 2026-09-24 21:00:46 UTC
- NVD CVSS v3.1
- 6.5 / 10 MEDIUM source: cve@rapid7.com
- NVD CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H- Exploitability subscore
- 2.8 / 10
- Impact subscore
- 3.6 / 10
NVD / KEV / EPSS data refreshed 2026-09-25 04:36 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2026-85882 - Assigner
- rapid7
- Published
- Sep 24, 2026, 1:50:40 PM
- Updated
- Sep 24, 2026, 2:48:39 PM
- EUVD base score (CVSS 3.1)
-
6.5 / 10
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - EUVD-reported EPSS
- 0.0000
- Vendors
- Rapid7
- Products
-
Velociraptor (0 <0.77.2)
- Aliases
-
GHSA-599v-36j6-3rj2
ENISA description: Velociraptor contains a deadlock condition that may be triggered by authenticated users. The issue stems from a lock management bug in the user management module.
Affected products (1)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| Rapid7 | Velociraptor |
0 (affected)
|
Linux |
Vendor references (2)
References embedded in the original CVE record by the assigning CNA.
Web references (0)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
No web references attached yet.
NVD-tagged references (2)
Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.
Remediations (10)
-
web:anonhaven.com
A server-side request forgery (SSRF) vulnerability was identified in the notebook viewer of GitHub Enterprise Server. The notebook viewer validated the scheme and host of a user-supplied URL but did not validate the port, allowing requests to be directed to internal services listening on other ports of the same appliance. …
2026-09-25 10:47 UTC -
web:cvebrief.com
Google · Chrome A use after free vulnerability exists in the Platform component of Google Chrome, which could allow a remote attacker to execute arbitrary code. Quick facts CVSS score 8.8 (High) Fix available Yes: 152..7977.65 ( CVE record) Affected versions Google Chrome: 152..7977.65 up to (excluding) 152..7977.65 First covered August 26, 2026 daily brief Last analyzed 2026 -08-26 ...
2026-09-25 10:47 UTC -
web:sec.cloudapps.cisco.com
On September 16, 2026 , the Cisco Product Security Incident Response Team (PSIRT) published the advisories that are listed in the following tables. To remediate these vulnerabilities, Cisco strongly recommends that customers upgrade to the fixed software that is indicated in the advisories. For more information about changes in Cisco PSIRT vulnerability disclosure, see Strengthening the ...
2026-09-25 10:47 UTC -
web:securityonline.info
Critical GitHub Enterprise Server vulnerabilities allow remote code execution. Update your instances now to mitigate these high-severity security flaws.
2026-09-25 10:47 UTC -
web:vulners.com
CVE - 2026 -77898 is a heap-based buffer overflow in Microsoft Office that allows an unauthorized attacker to achieve remote code execution over a network. The vulnerability requires user interaction (e.g., opening a crafted file) and has a high atta...
2026-09-25 10:47 UTC -
web:www.aikido.dev
CVE remediation is fixing known flaws in the software you run. Why upgrading often fails, what remediation actually involves, and how backporting fixes it.
2026-09-25 10:47 UTC -
web:www.cve.org
At cve .org, we provide the authoritative reference method for publicly known information-security vulnerabilities and exposures
2026-09-25 10:47 UTC -
web:www.cvefind.com
CVE Find is a real-time vulnerability database indexing 397 484 security flaws ( CVE ) from MITRE, NVD, CISA KEV, CWE and CAPEC. 2476 new CVEs were published in the last 7 days. Data aggregated from: MITRE Corporation ( CVE , CWE, CAPEC), National Vulnerability Database - NIST (NVD), CISA Known Exploited Vulnerabilities (KEV), FIRST (EPSS).
2026-09-25 10:47 UTC -
web:www.oracle.com
Oracle Critical Patch Update Advisory - April 2026 Description A Critical Patch Update is a collection of patches for multiple security vulnerabilities. These patches address vulnerabilities in Oracle code and in third party components included in Oracle products. These patches are usually cumulative, but each advisory describes only the security patches added since the previous Critical Patch ...
2026-09-25 10:47 UTC -
web:www.oracle.com
This Critical Patch Update contains 1448 new security patches across the product families listed below. Please note that a My Oracle Support (MOS) note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at July 2026 Critical Patch Update: Executive Summary and Analysis.
2026-09-25 10:47 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2026-77798.json.
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77798",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-24T14:48:32.322715Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T14:48:39.415Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "Velociraptor",
"platforms": [
"Linux"
],
"product": "Velociraptor",
"repo": "https://github.com/Velocidex/velociraptor/",
"vendor": "Rapid7",
"versions": [
{
"lessThan": "0.77.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yuval Miller and Leon Kayaliev"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Velociraptor contains a deadlock condition that may be triggered by authenticated users. The issue stems from a lock management bug in the user management module."
}
],
"value": "Velociraptor contains a deadlock condition that may be triggered by authenticated users. The issue stems from a lock management bug in the user management module."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-833",
"description": "CWE-833 Deadlock",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T13:50:40.310Z",
"orgId": "9974b330-7714-4307-a722-5648477acda7",
"shortName": "rapid7"
},
"references": [
{
"url": "http://docs.velociraptor.app/announcements/advisories/cve-2026-7798/"
},
{
"url": "https://github.com/Velocidex/velociraptor/commit/b64d915422da2e8366781bea2b5c5e6808df829c"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Velociraptor Authenticated Denial of Service",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "9974b330-7714-4307-a722-5648477acda7",
"assignerShortName": "rapid7",
"cveId": "CVE-2026-77798",
"datePublished": "2026-09-24T13:50:40.310Z",
"dateReserved": "2026-08-21T13:21:31.511Z",
"dateUpdated": "2026-09-24T14:48:39.415Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}