Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-78413— Velociraptor privilege escalation via SysmonLogForward client monitoring artifact

Quick assessment

Affected
Rapid7 Velociraptor
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Velociraptor 支持从端点收集打包在“Artifacts”（制品）中的 VQL 查询。这些制品功能强大，通常以高权限运行，能够执行各种操作。为了限制对某些危险制品的访问，Velociraptor 允许对部分制品设置高权限要求，例如必须拥有 EXECVE 权限才能触发执行。 是一个用于将 Sysmon 事件转发至服务器的监控型制品。该制品允许用户指定任意二进制文件路径作为参数，但未强制要求额外的权限验证。因此，拥有 COLLECT_CLIENT 权限的用户（通常由“Investigator”角色赋予）可以从

CVSS 5.5 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-78413

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Velociraptor privilege escalation via SysmonLogForward client monitoring artifact
Source: CVE Program / CVE List V5
Vulnerability Description
Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usually run with elevated permissions. To limit access to some dangerous artifact, Velociraptor allows for those to require high permissions like EXECVE to launch. The `Windows.Sysinternals.SysmonLogForward` is a monitoring artifact used to forward sysmon events to the server. The artifact allows the user to specify an arbitrary binary path as a parameter, and did not enforce an additional required permission, allowing users with COLLECT_CLIENT permissions (normally given by the "Investigator" role) to collect it from endpoints and run a different binary program than the installed sysmon binary. To successfully exploit this vulnerability the user must already have access to collect artifacts from the endpoint (i.e. have the COLLECT_CLIENT given typically by the "Investigator" role).
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
缺省权限不正确
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Rapid7 Velociraptor 0 ~ 0.77.3 -

II. Public POCs for CVE-2026-78413

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-78413

请登录查看更多情报信息。

Other References for CVE-2026-78413 (2)

Same Patch Batch · Rapid7 · 2026-10-05 · 3 CVEs total

CVE-2026-78411 6.5 MEDIUM Velociraptor Server Metadata update with Insufficient Permission Check
CVE-2026-78412 4.9 MEDIUM WatchEvent API streams another organization's live events

IV. Related Vulnerabilities

Same product: Velociraptor
Same vendor: Rapid7
Same weakness: CWE-276

V. Comments for CVE-2026-78413

No comments yet

Leave a comment