# CVE-2026-19200: Velociraptor verify() function artifact overwrite privilege escalation

Source: https://junglewise.ai/threats/cve-2026-19200-velociraptor-verify-function-artifact-overwrite-privilege  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-19200 · Severity: high · CVSS 8.9 · Published 2026-08-24

Velociraptor is a digital forensics and endpoint management platform used by security teams to conduct investigations and collect data from endpoints. A flaw in the verify() function allows users with analyst privileges (NOTEBOOK_EDIT permission) to overwrite critical built-in artifacts that should be read-only, potentially compromising the integrity of investigations and enabling malicious query execution across the platform.

Technologies: [Velocidex Velociraptor](https://junglewise.ai/threats/technologies/velociraptor). Vendors: [Velocidex](https://junglewise.ai/threats/vendors/velocidex).

## Quick answers

**Is CVE-2026-19200 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-19200 being exploited in the wild.

**How severe is CVE-2026-19200?** High severity, with a CVSS score of 8.9, published 24 August 2026.

**Which products and versions are affected?** Velocidex Velociraptor before 0.77.2.

**Is there a fix for CVE-2026-19200?** A patch was published on 2026-08-07: Fix merged in PR #4962; version 0.77.2 released with patch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-19200 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-19200?** Check whether you run Velocidex Velociraptor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The verify() VQL function, intended to validate artifact syntax and configuration, fails to properly enforce permission checks when accessing the global artifact repository. An attacker with the NOTEBOOK_EDIT permission (typically granted to analysts) can exploit this flaw to overwrite existing artifacts without proper authorization. The vulnerability allows direct manipulation of production artifacts through the verify() plugin, which incorrectly uses a global repository instead of a sandboxed temporary repository. This privilege escalation can be leveraged to inject malicious VQL code into artifacts that execute during normal platform operations. The fix involves using a temporary repository specifically for the verify() function, preventing modifications to the live artifact store.

## Affected products

- Velocidex Velociraptor before 0.77.2

## Timeline

- 2026-08-24: disclosed
- 2026-08-07: patched: Fix merged in PR #4962; version 0.77.2 released with patch

## References

- [http://docs.velociraptor.app/announcements/advisories/cve-2026-19200/](http://docs.velociraptor.app/announcements/advisories/cve-2026-19200/)
- [https://github.com/Velocidex/velociraptor/pull/4962](https://github.com/Velocidex/velociraptor/pull/4962)

## Related threats

- [Velociraptor SQL plugin missing authorization checks](https://junglewise.ai/threats/cve-2026-85737-velociraptor-is-a-tool-for-collecting-host-based-state)
- [Velociraptor privilege escalation in Windows.Sysinternals.SysmonLogForward artifact](https://junglewise.ai/threats/cve-2026-78413-velociraptor-allows-collection-of-vql-queries-packaged-into)
- [Velociraptor deadlock condition in user management module](https://junglewise.ai/threats/cve-2026-77798-velociraptor-contains-a-deadlock-condition-that-may-be-triggered)
- [Velociraptor VQL injection in notebook backup restore](https://junglewise.ai/threats/cve-2026-19584-velociraptor-vql-injection-in-notebook-backup-restore)
- [Velociraptor permission bypass via client monitoring artifacts](https://junglewise.ai/threats/cve-2026-19583-velociraptor-permission-bypass-via-client-monitoring-artifacts)