Beveiligingsadvies

CVE-2026-18348

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2026-08-11 05:37:11

Laatst bijgewerkt 2026-08-11 14:22:11

Toegewezen door rapid7

CVSS-score 4.1

Status PUBLISHED

Beschrijving

Missing authorization check in the upload_azure, upload_sftp, and upload_smb VQL plugins allows an authenticated analyst-role user can initiate attacker-controlled outbound network connections from the Velociraptor server, bypassing the NETWORK ACL permission boundary. This enables internal network reconnaissance via port oracle and potential data exfiltration to external endpoints.

← Alle CVE's bekijken Bekijk op cve.org ↗