CVE-2026-19583

Velociraptor normally requires specific permissions, such as EXECVE, before sensitive artifacts like Linux.Sys.BashShell — which allows arbitrary command execution on endpoints — can be scheduled. However, no permission check was enforced when scheduling client monitoring artifacts, and client monitoring artifacts were also not required to carry the CLIENT_EVENTS type. As a result, any user with the ability to schedule client monitoring artifacts can schedule otherwise restricted artifacts and gain arbitrary command execution on managed endpoints without holding the required permission. Organizations running affected Velociraptor deployments are exposed, particularly those granting artifact-scheduling rights to lower-privileged analyst roles, which matches the CVSS 3.1 score of 9.9 with low privileges required and impact spanning multiple components. No exploitation has been reported: the flaw is not in CISA KEV and no public proof-of-concept is known.

What to do: Upgrade Velociraptor to the fixed release identified in the Rapid7 advisory. As an interim mitigation, restrict which users and roles can schedule client monitoring artifacts, and review recent client monitoring collections for unexpected or restricted artifacts such as Linux.Sys.BashShell.