Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Missing authorization check in the upload_azure, upload_sftp, and upload_smb VQL plugins allows an authenticated analyst-role user can initiate attacker-controlled outbound network connections from the Velociraptor server, bypassing the NETWORK ACL permission boundary. This enables internal network reconnaissance via port oracle and potential data exfiltration to external endpoints.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-08-11 | 1 | Disclosure1 |
| 2026-08-15 | 1 | General1 |
It's been a while .... 3 new CVEs in @velocidex by @rapid7 CVE-2026-18860 CVE-2026-18640 CVE-2026-18348 https://t.co/yEWuS2qN6i
Post summary
The tweet simply announces three new CVEs for Velocidex, offering no further information on exploitation, patches, or technical characteristics.
CVE-2026-18348 Missing authorization check in the upload_azure, upload_sftp, and upload_smb VQL plugins allows an authenticated analyst-role user can initiate attacker-controlled ou… https://www.cve.org/CVERecord?id=CVE-2026-18348
Post summary
The text announces CVE‑2026‑18348, describing a missing authorization check in specific VQL plugins that could allow an attacker to control operations as an authenticated analyst‑role user, but contains no proof‑of‑concept, exploit tool, active exploitation claim, patch information, or debunking statement.