VulnSocial

CVE-2026-19072

LOWCVSS 9.9 · CRITICAL

Signal is active with 4 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Velociraptor stores the compiled VQL in the hunt object internally to avoid having to recompile the artifacts for each endpoint in the hunt. Although the field "compiled_collector_args" is an internal field, Velociraptor allowed the field to be set from a user API call. This allows another user who can schedule a hunt (minimal role of "investigator" ) to set the compiled VQL statements for the hunt bypassing any ACL checks that would normally be applied. This flaw can then be escalated to allow the "investigator" user to run arbitrary VQL statements as an administrator user on the Velociraptor server.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-164CWE-1269

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 4 mentions across 1 observed day

What's happening

  • 4 total mentions across 1 day

Deep dive

Activity timeline4 mentions / 1d
01234Mentions · 2026-09-25: 409-25
Referenced assets2 URLs
Full discourse4 posts
  • ExploitGrid@exploitgrid

    ├ CVE-2026-19072 — Velociraptor · Privilege escalation to SuperUser └ CVE-2026-93425 — Dokploy · Auth'd OS command injection

    1000039
    47 followersView on X
  • ExploitGrid@exploitgrid

    [CVE] CVE-2026-19072 [HIGH PRIORITY] #Velociraptor Investigator reaches SuperUser via hunt EffectivePrincipal 🔗 https://exploitgrid.net/cve/CVE-2026-19072

    1000028
    47 followersView on X
  • ExploitGrid@exploitgrid

    🛡️ #ExploitGrid Daily #Threat Digest Top Vulnerabilities (CVEs) of the day CVE-2026-61732 CVE-2026-97359 CVE-2026-97360 CVE-2026-19072 CVE-2026-93425 ..🧵👇

    1000038
    47 followersView on X
  • Cybersecurity News DE@cybsecuritynews

    #schwachstellen Velociraptor-Lücke CVE-2026-19072 erlaubt Rechteausweitung bis zum Administrator #cve202619072 #dfir #velociraptor #vql https://cybersecurity-news.de/velociraptor-cve-2026-19072-rechteausweitung-administrator

    0000028
    13 followersView on X

Explore more

Back to dashboard