What is CVE-2026-19200?

CVE-2026-19200 is a high-severity vulnerability in Rapid7 Velociraptor, classified under Code Injection. CVSS score: 8.9/10. Published 2026-08-24.

How severe is CVE-2026-19200?

High severity. CVSS v3 base score is 8.9 out of 10.

RCE in Rapid7 Velociraptor

CVE-2026-19200

The Velociraptor verify() VQL function allows a user to verify an artifact for syntatic and other issues. Due to an implementation fault in this VQL function, the global artifact repository is used which allows callers to overwrite existing artifacts without the required permissions. The attacker need only have the NOTEBOOK_EDIT permission (e.g. an analyst role) to be able to call this function.

Vulnerability class: RCE (Remote Code Execution)

CVSS v3 metric

CVSS v3 base score 8.9 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L.

Affected products

Rapid7 Velociraptor

Weakness classification (CWE)

CWE-94 — Code Injection
CWE-862 — Missing Authorization

References

cve@rapid7.com
cve@rapid7.com

Frequently asked questions

What is CVE-2026-19200?: CVE-2026-19200 is a high-severity vulnerability in Rapid7 Velociraptor, classified under Code Injection. CVSS score: 8.9/10. Published 2026-08-24.
How severe is CVE-2026-19200?: High severity. CVSS v3 base score is 8.9 out of 10.