CVE-2026-18860
CVE-2026-18860 is a high-severity vulnerability with a CVSS 3.x base score of 8.7. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-280.
Key facts
- Severity: High (CVSS 3.x base score 8.7)
- EPSS exploit prediction: 0% (23rd percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-280
- Published:
- Last modified:
Description
Velociraptor allows multi-tenant deployments named "Orgs". By default Velociraptor, uses the ROOT org, but users can create child orgs for other tenants within the same deployment. Users can have different permissions in each org. To manage Orgs, Velociraptor usually examines the ORG_ADMIN permission on the ROOT org. This issue results from the Velociraptor server allowing for the deletion of Orgs by incorrectly checking the ORG_ADMIN permission of callers within the calling ORG instead of the ROOT org. However, Org admins of child orgs were able to add this permission to their ACL token within their own org. This allows an administrator in a child org, which is not also an administrator in the ROOT org, to delete other orgs.
Frequently asked questions
- What is CVE-2026-18860?
- Velociraptor allows multi-tenant deployments named "Orgs". By default Velociraptor, uses the ROOT org, but users can create child orgs for other tenants within the same deployment. Users can have different permissions in each org. To manage Orgs, Velociraptor usually examines the ORG_ADMIN permission on the ROOT org. This issue results from the Velociraptor server allowing for the deletion of Orgs by incorrectly checking the ORG_ADMIN permission of callers within the calling ORG instead of the ROOT org. However, Org admins of child orgs were able to add this permission to their ACL token within their own org. This allows an administrator in a child org, which is not also an administrator in the ROOT org, to delete other orgs.
- How severe is CVE-2026-18860?
- CVE-2026-18860 has a CVSS 3.x base score of 8.7, rated high severity. It is exploitable over network with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is none, integrity high, and availability high.
- Is CVE-2026-18860 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (23rd percentile), an estimate of the probability of exploitation in the next 30 days.
- How do I fix CVE-2026-18860?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- When was CVE-2026-18860 published?
- CVE-2026-18860 was published on 2026-08-11.
References
- https://docs.velociraptor.app/announcements/advisories/cve-2026-18860/
- https://github.com/Velocidex/velociraptor/commit/dc38bd6a7e12a678cd79e726bdd1ded4eed75967
Other CWE-280 vulnerabilities
- CVE-2025-46066 — Critical (CVSS 9.9): An issue in Automai Director v.25.2.0 allows a remote attacker to escalate privileges
- CVE-2025-6573 — Critical (CVSS 9.8): Kernel software installed and running inside an untrusted/rich execution environment (REE) could leak information from…
- CVE-2024-24116 — Critical (CVSS 9.8): An issue in Ruijie RG-NBS2009G-P RGOS v.10.4(1)P2 Release(9736) allows a remote attacker to gain privileges via the…
- CVE-2026-41566 — Critical (CVSS 9.4): Improper Handling of Insufficient Permissions or Privileges vulnerability in Apache Kvrocks. This issue affects Apache…
- CVE-2024-1608 — Critical (CVSS 9.1): In OPPO Usercenter Credit SDK, there's a possible escalation of privilege due to loose permission check, This could…
- CVE-2026-24096 — High (CVSS 8.8): Insufficient permission validation on multiple REST API Quick Setup endpoints in Checkmk 2.5.0 (beta) before version…