What is CVE-2026-64955?

CVE-2026-64955 is a medium-severity vulnerability in Rapid7 Velociraptor, classified under Improper Neutralization of Formula Elements in a CSV File. CVSS score: 6.1/10. Published 2026-08-12.

How severe is CVE-2026-64955?

Medium severity. CVSS v3 base score is 6.1 out of 10.

Vulnerability in Rapid7 Velociraptor

CVE-2026-64955

When Microsoft Excel imports a CSV file, it executes cells beginning with certain characters as formulas, giving such CSV files arbitrary execution. Velociraptor fails to sanitize such cells when exporting to CSV from various places such…

CVSS v3 metric

CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N.

Affected products

Rapid7 Velociraptor — versions 0

Weakness classification (CWE)

CWE-1236 — Improper Neutralization of Formula Elements in a CSV File

References

cve@rapid7.com

Frequently asked questions

What is CVE-2026-64955?: CVE-2026-64955 is a medium-severity vulnerability in Rapid7 Velociraptor, classified under Improper Neutralization of Formula Elements in a CSV File. CVSS score: 6.1/10. Published 2026-08-12.
How severe is CVE-2026-64955?: Medium severity. CVSS v3 base score is 6.1 out of 10.