This release is a bug fix release and addresses the CVEs published in the 0.77.3 release cycle.

Detailed change log below (AI generated).

Artifact changes

• Added Azure.Monitor.Upload, which uploads server-side artifact results to an Azure Monitor Log Analytics workspace. Takes a table name, a Data Collection Rule id, and either a client secret or a managed identity. (#4974, 2026-09-04)
• Server.Utils.BackupDirectory, Server.Utils.BackupGCS and Server.Utils.BackupS3 now emit only ClientId, FlowId and the fields derived from them, rather than all columns. Downstream consumers reading a column that is no longer emitted will need updating. (#4999, 2026-09-04)
• Windows.Forensics.Prefetch reads VolumeSerialNumber at offset 16 rather than 12. (#5000, 2026-09-09)
• Windows.Registry.EnableUnsafeClientMailRules reads the target user's NTUser path rather than the collector's OSPath. (#5016, 2026-09-17)

Bug fixes

• The registry accessor parses MULTI_SZ values correctly. (#4972, 2026-08-12)
• Flow completion now waits for the final FlowStats write. (#4982, 2026-08-25)
• ArtifactName is read from the cell environment rather than passed as a parameter. (#4990, 2026-08-25)
• Pool clients report the correct hostname in compressed responses. (#5003, 2026-09-08)
• Filestore StatFile() reports the uncompressed file size. (#5024, 2026-09-18)
• The events view in the GUI no longer breaks on artifacts whose name contains a slash, such as Server.Monitor.Health/Prometheus. (#5001, 2026-09-15)
• A user's notebook view now lists notebooks shared with them, in line with the global notebook view. (#5001, 2026-09-15)
• enrollments_per_second: -1 disables enrollment instead of being ignored. (#5042, 2026-09-27)
  Globs with unbalanced alternatives, such as /bin/{ls, now report an error. (#5044, 2026-09-27)
  Internal
• Replaced the gRPC connection pool with a direct connection to the frontend. (#5022, 2026-09-18)
• Closed the gRPC channel from the returned closure. (#5014, 2026-09-14)
• Moved the client info manager's lock into the record locking system. (#5015, 2026-09-15)
• Serialised creation of the global eBPF manager. (#5031, 2026-09-20)
• Refactored the event queues, and split flow storage deletion into its own manager. (#5035, 2026-09-24, #5037, 2026-09-25)
• Added client event artifacts to the artifact verifier. (#5043, 2026-09-27)

This is a release to address the CVEs published in the 0.77.2 release cycle.

This is a back ported release for 0.76 branch to address some of the CVEs published in the 0.77.2 release cycle.

I am very excited to announce that the latest Velociraptor release 0.77.1 is now available.

The full release notes are found here

If you find any issues please file an issue on GitHub or chat with us on our discord server.

I am very excited to announce that the latest Velociraptor release 0.77.1-rc1 is now available for testing.

The full release notes are found here

If you find any issues please file an issue on GitHub or chat with us on our discord server.

I am very excited to announce that the latest Velociraptor release 0.76.6 is now available.

The full release notes are found here

If you find any issues please file an issue on GitHub or chat with us on our discord server.

This is a bugfix release.

Known issues

1. There is a bug with the velociraptor debian server command - please use an earlier release temporarily to build the deb with the latest binary:
   velociraptor --config server.config.yaml debian server --binary velociraptor-v0.76.6-linux-amd64-musl

Latest release is 0.76.5

Please note: Due to a GitHub sorting bug the 0.75 release is shown first, but the latest release is 0.76. The most reliable way to download the latest release is from the Download page or scroll below to see it.

I am very excited to announce that the latest Velociraptor release 0.75.3 is now available for download.

The full release notes are found here

If you find any issues please file an issue on GitHub or chat with us on our discord server.

Bugfixes in 0.75.2

• Bugfix: When using https clients would retry too quickly on 503 (#4461)
• Bugfix: Limit number of entries emitted into process_tracker_tree() (#4454)
• Bugfix: Uploading artifact pack was limited to 4mb (#4453)
• Bugfix: Windows.Forensics.Lnk had a bad performance bug (#4445)
• Bugfix: Initial notebooks for artifacts with no sources. (#4443)
• Bugfix: Layout of toolbars in the notebooks screen was messed up (#4439)
• Bugfix: Offline collector undefined fields should not be set (#4436)
• Bugfix: Single tag values to artifact_set_metadata() were ignored (#4429)

Bugfixes in 0.75.3

• Bugfix: Windows.Detection.Yara.PhysicalMemory was broken (#4499)
• Bugfix: Re-parse generated config file for GUI and offline command. (#4497)
• Added Windows.System.Threads artifact (#4496)
• Add sharphound artifact (#4492)
• Added yarax() plugin. (#4488)
• Bring back CreateTime so these can be used in timelines (#4486)
• Updated watch_syslog() to accept a query (#4480)
• Bugfix: Fix secrets enforcement logic (#4479)
• Bugfix: iops limit in throttler (#4474)
• Bugfix: Hunt flows table lost its flow link (#4469)
• Bugfix: Fix crash in resumable upload due to missing lock (#4465)
• Bugfix: Package creator did not set the run_as_user flag. (#4464)

Bugfixs in 0.75.4

• Bugfix: Backwards compatibility for watch_syslog() (#4504)

Bugfixes in 0.75.5

• Further performance optimizations (#4515)
• Bugfix: Reset all times when nanny detects a timeshift. (#4516)
• Bugfix: clear client selection when switching orgs. (#4519)
• More work on nanny. (#4522)
• Secrets can now be inherited from the root org (#4524)
• Bugfix: Allow upload_gcs() to use proxy configuration. (#4526)
• Bugfix: Update evtx parser to support non-english systems. (#4530)
• Bugfix: Deduplicate uploads by case insensitive name on windows. (#4533)
• Let the user know when critical errors happen via Global Messages (#4535)
• Bugfix: Set default theme to veloci-light (#4539)
• Added path_style option to upload_s3() (#4540)
• Fix table CSS when the table is empty. (#4545)
• Bugfix: Ensure client is created when a client id is provided (#4541)
• Bugfix: Added denied_file_accessor_prefix config option (#4548)
• Added a decrypt command to decrypt an encrypted container. (#4551)

Bugfixes in 0.75.6

• Address CVE-2025-14728
• Bugfix: Update Linux.Events.TrackProcesses to use HostPids
• Bugfix: GCS storage library did not load credentials. (#4598)
• Bugfix: Backwards compatibility for watch_syslog() (#4504)
• Improve sanitization of paths (#4593)
• Fix panic/error in zip accessor handling (#4589)
• fix: missing rpm release specification (#4587)
• Log audit information on the client. (#4585)
• Reworked client label button to separate removal action. (#4583)
• Support ADFS which gives the OIDC claims in the access token. (#4575)

NOTE

To address CVE 2026-5329 Please upgrade your server to 0.75.7

I am very excited to announce that the latest Velociraptor release 0.76.1 is now available.

The full release notes are found here

If you find any issues please file an issue on GitHub or chat with us on our discord server.

NOTE

To address the following CVEs, please upgrade your server to 0.76.5:

• CVE-2026-5329 -Velociraptor improper input validation in client message handler
• CVE-2026-6290 Velociraptor query() plugin misapplies permissions to orgs
• CVE-2026-6863 HTTP Filestore Endpoints Misapply Permissions Across Organizations
• CVE-2026-6948 Unbounded Memory Allocation in VQLResponse Result-Set Writer

Download this release from the Downloads Page

I am very excited to announce that the latest Velociraptor release 0.74.5 is now in available.

Detailed release notes are at https://docs.velociraptor.app/blog/2025/2025-02-23-release-notes-0.74/

The major new feature in this release is reworking of the new Sigma editor as well as many new live event sources for Linux and Windows. You can read all about the latest timeline feature in our blog post Developing Sigma Rules in Velociraptor

If you find any issues please file an issue on GitHub or chat with us on our discord server.

Breaking Changes:

• 0.74-2 had relaxed sanitazation on the elastic index names to be more consistent with the official Elastic rules. This might change the names of indexes in your pipeline.

NOTE

To address CVE 2026-5329 Please upgrade your server to 0.74.7

I am very excited to announce that the latest Velociraptor release 0.73 is now in available for download.

Detailed release notes are at https://docs.velociraptor.app/blog/2024/2024-09-10-release-notes-0.73/

The major new feature in this release is a revamp of the timelining feature. You can read all about the latest timeline feature in our blog post https://docs.velociraptor.app/blog/2024/2024-09-12-timelines/

If you find any issues please file an issue on GitHub or chat with us on our discord server.

Note

Release 0.73.5 is a server only release to address CVE-2025-30204 in go-jwt. If you do not use oauth you do not need to upgrade.