How severe is CVE-2026-77798?

CVE-2026-77798 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2026-77798 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (9th percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2026-77798?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2026-77798 published?

CVE-2026-77798 was published on 2026-09-24.

CVE-2026-77798

CVE-2026-77798 is a medium-severity vulnerability with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-833.

Key facts

Severity: Medium (CVSS 3.x base score 6.5)
EPSS exploit prediction: 0% (9th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-833
Published: 2026-09-24
Last modified: 2026-09-24

Description

Velociraptor contains a deadlock condition that may be triggered by authenticated users. The issue stems from a lock management bug in the user management module.

Frequently asked questions

What is CVE-2026-77798?: Velociraptor contains a deadlock condition that may be triggered by authenticated users. The issue stems from a lock management bug in the user management module.
How severe is CVE-2026-77798?: CVE-2026-77798 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2026-77798 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (9th percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2026-77798?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2026-77798 published?: CVE-2026-77798 was published on 2026-09-24.

References

Other CWE-833 vulnerabilities

CVE-2025-10150 — High (CVSS 8.7): Webserver crash caused by scanning on TCP port 80 in Softing Industrial Automation GmbH gateways and switch.This issue…
CVE-2026-46352 — High (CVSS 7.5): Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine.…
CVE-2025-1713 — High (CVSS 7.5): When setting up interrupt remapping for legacy PCI(-X) devices, including PCI(-X) bridges, a lookup of the upstream…
CVE-2022-43767 — High (CVSS 7.5): A vulnerability has been identified in SIMATIC CP 1242-7 V2 (6GK7242-7KX31-0XE0) (All versions < V3.4.29), SIMATIC CP…
CVE-2025-8312 — High (CVSS 7.1): Deadlock in PAM automatic check-in feature in Devolutions Server allows a password to remain valid beyond the end of…
CVE-2026-105792 — Medium (CVSS 6.5): Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the…

Browse all CWE-833 vulnerabilities →