Column 1
Skip to content

Velociraptor 0.77.2: Security Maintenance Checklist

September 10, 2026

Administrators running affected Rapid7 Velociraptor deployments should review two permission-related advisories and move to a supported release that includes the 0.77.2 fixes. This is a focused maintenance checklist for CVE-2026-19583 and CVE-2026-19584, not a claim that every Linux server is vulnerable.

Scope and evidence: Fix I.T. Phill has not assessed your Velociraptor deployment. This guide is based on the vendor advisories and current CVE records, not testing against customer systems. The vendor pages were published on August 15 and July 31, 2026; their September 10 CVE-record publication dates do not mean the vulnerabilities or fixes were first disclosed today. We have not independently confirmed active exploitation.

Which deployments need attention?

Both vendor tables identify Rapid7 Velociraptor on Linux before 0.77.2 as affected. These are product-level permission issues, not Linux-kernel vulnerabilities. Do not apply this version number to another security tool or an operating-system package.

  • CVE-2026-19583: A permissions weakness can allow an authenticated investigator to perform activity intended to require stronger authorization. Review the assigned investigator roles and update affected deployments. The vendor’s stated prerequisites matter; this is not an unauthenticated access claim.
  • CVE-2026-19584: A separate permission weakness involves notebook recovery and an authenticated investigator able to edit notebooks. The risk involves a subsequent restore, so recovery-source trust and review are part of the maintenance plan.

The two issues share a product and fixed-release boundary, which is why they are covered in one maintenance guide. Their prerequisites are not interchangeable. See the CVE-2026-19583 vendor advisory and CVE-2026-19584 vendor advisory for the authoritative scope.

Plan the update

  1. Confirm the product and running version. Use your existing authorized administration records and the product’s normal version display. Identify the server and client components you manage; do not assume a downloaded package is the version currently running.
  2. Select a supported patched release. The advisories identify versions before 0.77.2 as affected. Choose a supported release containing those fixes and review the release-specific compatibility notes for your installed version before scheduling the change.
  3. Agree on maintenance and recovery ownership. Record who will perform the update, validate normal investigations, and decide whether a rollback is appropriate. Follow your existing approved recovery policy; do not change customer backup schedules as a side effect.
  4. Review access deliberately. Check that investigator assignments are still necessary and approved. Do not broaden permissions or disable protections to make an old workflow continue working.
  5. Update through the official distribution path. Apply the documented upgrade process for your deployment and check component compatibility. This guide does not substitute a generic command for that deployment-specific procedure.

Verify without reproducing the vulnerabilities

After the maintenance window, confirm the running version, service health, expected client connectivity, and a routine authorized investigation. Have the responsible administrator confirm that intended role boundaries still match the team’s policy. Do not use untrusted test code or attempt to demonstrate the permission weaknesses on production systems.

For notebook recovery, use a trusted, reviewed recovery source and the vendor’s guidance. Do not automatically restore material from an untrusted source. A successful restore alone is not a security review of its contents.

Installing a patched release alone does not establish that an earlier compromise is absent. If ordinary administrative review finds unexpected activity or permissions, preserve relevant evidence privately and follow your incident-response process. Keep credentials, investigation data and recovery material out of public support tickets.

Keep application and hosting maintenance separate

Teams using Velociraptor alongside hosted websites should coordinate the security-tool maintenance with the people responsible for those sites. A Velociraptor update does not patch WordPress, its plugins, or the hosting control panel. Our WordPress support service can help plan the separate website-maintenance work without confusing the two scopes.

Image note: the featured image is a generic Linux security-maintenance illustration, not a Velociraptor interface or evidence of a customer incident.

Sources and review