CVE-2026-18638: RAPID7 Velociraptor

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

Any authenticated Velociraptor user — including one holding only the readerrole — can terminate the entire server process with a single request, by calling SetPassword with a username that does not exist.

Affected products

• RAPID7 Velociraptor: before 0.77.2 (fixed in 0.77.2)

Published 2026-08-11. Last modified 2026-08-28.