CVE-2026-6948
MEDIUM EPSS 26.3%
Published May 4, 20261mo ago · Modified Jun 17, 20262w ago
4.9 CVSS 3.1
Published May 4, 2026 1mo ago
Last Modified Jun 17, 2026 2w ago
Description
Velociraptor versions prior to 0.76.4 contain a resource exhaustion vulnerability in the server's agent control channel. This allows a compromised or rogue Velociraptor client to crash the server via out-of-memory (OOM) by sending crafted messages through the normal client communication channel.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H Attack Vector Network
Attack Complexity Low
Privileges Required High
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High
Threat Intelligence
EPSS Exploit Probability
26.3% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-770
References 1
- docs.velociraptor.app https://docs.velociraptor.app/announcements/advisories/cve-2026-6948/
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.