PT-2026-36730 · Unknown · Velociraptor

Faisal Alhumaid + 1 · CVE-2026-6948 · Published 2026-05-03 · Updated 2026-05-04

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Velociraptor versions prior to 0.76.4

Description A resource exhaustion issue exists in the server's agent control channel. A compromised or rogue client can crash the server by causing out-of-memory (OOM) conditions through the transmission of crafted messages via the standard client communication channel.

Recommendations Update to version 0.76.4 or later.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-6948

Affected Products

Velociraptor

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/6xxx/CVE-2026-6948.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-6948 · Security Note
• https://osv.dev/vulnerability/CVE-2026-6948 · Vendor Advisory
• https://github.com/Velocidex/velociraptor · Note
• https://twitter.com/VulmonFeeds/status/2051109236415799559 · Twitter Post
• https://t.me/CVEtracker/52589 · Telegram Post
• https://docs.velociraptor.app/announcements/advisories/cve-2026-6948 · Note
• https://twitter.com/CVEarity/status/2051364746809745730 · Twitter Post
• https://t.me/cveNotify/161955 · Telegram Post
• https://twitter.com/CVEnew/status/2051110085364011381 · Twitter Post