All intelligence
// vulnerability record
cached · NVD via COSMOS syncCVE-2026-18638
MEDIUMpublished 2026-08-11 16:17 UTC · 1 day ago · modified 2026-08-11 18:17 UTC
6.5
CVSS / 10
// description
Any authenticated Velociraptor user — including one holding only the readerrole — can terminate the entire server process with a single request, by calling SetPassword with a username that does not exist.
// weaknesses (CWE)
- CWE-476
- CWE-703