CVE-2026-77798: 
Velociraptor vulnerability analysis and mitigation

CVE-2026-77798 is a deadlock vulnerability in Rapid7's Velociraptor digital forensics and incident response (DFIR) platform, caused by a lock management bug in the user management module. It was published on September 24, 2026, and affects all Velociraptor versions prior to 0.77.2. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium), reflecting its network-accessible, low-privilege attack vector with high availability impact (GitHub Advisory, Feedly).

The vulnerability is classified as CWE-833 (Deadlock), corresponding to CAPEC-25 (Forced Deadlock). A lock management bug in Velociraptor's user management module allows multiple threads or execution paths to enter a mutually blocking wait state, causing the service to become unresponsive. The fix, committed in b64d915, addresses the deadlock in the user manager alongside related changes such as restricting OrgId to be set only from HTTP headers (GitHub Commit). Exploitation requires only low-level authenticated access over the network with no user interaction needed (GitHub Advisory).

Successful exploitation causes a denial-of-service condition by triggering a deadlock that renders the Velociraptor service unresponsive. There is no confidentiality or integrity impact — the sole consequence is high availability impact, disrupting forensic investigation and incident response operations that depend on the platform. Because Velociraptor is commonly deployed as a central DFIR management server, an outage could impede active security investigations and endpoint monitoring across an organization (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (Feedly). The NVD SSVC assessment classifies exploitation as "none" and the attack as non-automatable. The EPSS score is approximately 0.198% (9th percentile), indicating a low near-term probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

• Logs: Velociraptor server logs showing thread contention or lock acquisition failures in the user management module; repeated or hung requests to user management API endpoints.
• Process: Velociraptor server process becoming unresponsive or consuming CPU/memory abnormally without completing requests; goroutine dumps (if enabled) showing multiple threads blocked waiting on the same mutex.
• Network: Authenticated API calls to user management endpoints that do not return responses within expected timeframes, potentially from unexpected source IPs.

Upgrade Velociraptor to version 0.77.2 or later, which contains the fix for the deadlock in the user manager (GitHub Commit, Velociraptor Advisory). As a temporary measure, restrict access to the Velociraptor server to only trusted, necessary authenticated accounts to reduce the attack surface. Monitor the service for unresponsiveness or deadlock events as indicators of potential exploitation attempts (Feedly).