CVE-2026-18638: 
Velociraptor vulnerability analysis and mitigation

CVE-2026-18638 is a Denial of Service vulnerability in Rapid7's Velociraptor DFIR platform, classified under CWE-476 (NULL Pointer Dereference) and CWE-703 (Improper Check or Handling of Exceptional Conditions). Any authenticated user — including those with only the reader role — can crash the entire Velociraptor server process by calling the SetPassword API with a username that does not exist. All versions prior to 0.77.2 are affected. It was published on August 11, 2026, with a CVSS v3.1 base score of 6.5 (Medium) (Velociraptor Advisory).

The root cause is a NULL pointer dereference (CWE-476) combined with improper handling of exceptional conditions (CWE-703) in the SetPassword function. When a caller supplies a username that does not exist in the user store, the server fails to validate the lookup result before dereferencing it, causing a fatal panic that terminates the entire server process. Exploitation requires only a valid authenticated session — even the lowest-privilege reader role is sufficient — and no additional user interaction or complex conditions are needed. The attack is delivered over the network via a single crafted API request (Velociraptor Advisory).

Successful exploitation causes an immediate, complete crash of the Velociraptor server process, resulting in a full loss of availability for all users and agents connected to that instance. Because Velociraptor is a DFIR (Digital Forensics and Incident Response) platform, a server outage directly disrupts active investigations, live endpoint monitoring, and forensic data collection. There is no confidentiality or integrity impact; the vulnerability is purely a denial-of-service condition (Velociraptor Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the time of disclosure. The EPSS score is approximately 0.0029 (0.29%), indicating a low probability of near-term exploitation. The NVD SSVC assessment classifies exploitation as "none" and the vulnerability as non-automatable, reflecting the requirement for a valid authenticated session. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog (Velociraptor Advisory).

1. Obtain credentials: Acquire any valid Velociraptor account, including a low-privilege reader account, through legitimate access, credential theft, or social engineering.
2. Authenticate to the server: Log in to the Velociraptor GUI or API endpoint using the obtained credentials to establish an authenticated session.
3. Craft the malicious request: Construct an API call to the SetPassword function, supplying a username value that does not correspond to any existing user in the Velociraptor user store.
4. Send the request: Submit the crafted request to the Velociraptor server. The server attempts to look up the non-existent user, dereferences a NULL pointer, and the process crashes immediately.
5. Result: The entire Velociraptor server process terminates, denying service to all connected users and agents until the process is manually restarted (Velociraptor Advisory).

• Logs: Velociraptor server logs showing a fatal panic or crash trace referencing the SetPassword function with a non-existent username immediately before process termination.
• Logs: Repeated API calls to SetPassword with usernames not present in the user database, particularly from low-privilege accounts such as reader role users.
• Process: Unexpected termination of the Velociraptor server process (velociraptor binary) without a corresponding administrative shutdown event.
• Network: Authenticated API requests targeting the SetPassword endpoint with unusual or non-existent username values in the request body.

Rapid7 has released Velociraptor version 0.77.2, which fixes this vulnerability by properly validating the user lookup result before dereferencing it in SetPassword. All users running versions prior to 0.77.2 should upgrade immediately. As a temporary workaround, restricting API access to trusted, high-privilege accounts only and auditing user roles to minimize the number of accounts with any level of authenticated access can reduce exposure until patching is possible (Velociraptor Advisory).