CVE-2026-78413: 
Velociraptor vulnerability analysis and mitigation

CVE-2026-78413 is a privilege escalation vulnerability in Rapid7's Velociraptor DFIR platform, specifically within the Windows.Sysinternals.SysmonLogForward monitoring artifact. The artifact accepts an arbitrary binary path as a user-supplied parameter without enforcing the required elevated permission (EXECVE), allowing authenticated users with the COLLECT_CLIENT permission (typically granted to the "Investigator" role) to execute arbitrary binaries on monitored endpoints. All Velociraptor versions prior to 0.77.3 are affected. It was published on October 5, 2026, with a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Velociraptor Advisory).

The root cause is classified as CWE-276 (Incorrect Default Permissions): the Windows.Sysinternals.SysmonLogForward artifact failed to declare or enforce the EXECVE required permission in its artifact definition, despite allowing users to specify an arbitrary binary path as a parameter (GitHub Advisory). Velociraptor's permission model is designed so that dangerous operations — such as executing binaries — require explicit high-privilege permissions like EXECVE; however, this artifact bypassed that check, meaning any user with COLLECT_CLIENT (the standard Investigator role) could supply a malicious binary path and trigger its execution on endpoints. The fix, committed in PR #5043, adds required_permissions: EXECVE to the SysmonLogForward.yaml artifact definition and extends the artifact verifier to enforce required permissions on client event artifacts, including propagating permissions from sub-artifacts to caller artifacts.

An authenticated Velociraptor user with the Investigator role (COLLECT_CLIENT permission) can exploit this vulnerability over the network to execute an arbitrary binary program on managed endpoints in place of the legitimate Sysmon binary, potentially with elevated privileges depending on the context in which the Sysmon process runs. This could result in unauthorized code execution, data exfiltration, persistence establishment, or further lateral movement across all endpoints managed by the Velociraptor deployment. The scope is marked as "Changed" in the CVSS scoring, reflecting that the impact extends beyond the Velociraptor server itself to the monitored endpoint systems (GitHub Advisory, Velociraptor Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the attacker to already hold authenticated access to the Velociraptor console with at minimum the Investigator role, significantly limiting the attack surface. The EPSS score is approximately 0.157%, placing it in the 4th percentile for exploitation likelihood within 30 days (GitHub Advisory).

1. Gain Investigator Access: Obtain credentials for a Velociraptor user account with the COLLECT_CLIENT permission (Investigator role), either through credential theft, phishing, or insider access.
2. Access the Velociraptor Console: Log into the Velociraptor web console using the compromised Investigator account.
3. Locate the Vulnerable Artifact: Navigate to the artifact collection interface and select the Windows.Sysinternals.SysmonLogForward client event artifact.
4. Modify the Binary Path Parameter: When configuring the artifact collection, supply a malicious binary path in the artifact's binary path parameter instead of the legitimate Sysmon binary path (e.g., point it to a pre-staged malicious executable on the endpoint).
5. Collect the Artifact on Target Endpoints: Initiate collection of the artifact against one or more managed endpoints; the Velociraptor client on the endpoint will execute the specified binary with the permissions of the Sysmon/Velociraptor process.
6. Achieve Objective: The arbitrary binary executes on the endpoint, enabling the attacker to establish persistence, exfiltrate data, or pivot further within the environment (GitHub Advisory, Velociraptor Advisory).

• Logs: Velociraptor audit logs showing an Investigator-role user collecting the Windows.Sysinternals.SysmonLogForward artifact with a non-standard or unexpected binary path parameter.
• Logs: Velociraptor server logs recording artifact collection tasks targeting Windows.Sysinternals.SysmonLogForward with modified parameters on multiple endpoints.
• Process: Unexpected child processes spawned from the Sysmon or Velociraptor client process on endpoints (e.g., cmd.exe, powershell.exe, or unknown executables not matching the legitimate Sysmon binary path).
• File System: Presence of unknown or unsigned executables in paths referenced by the SysmonLogForward artifact parameter on endpoint systems.
• Network: Unusual outbound network connections from endpoints originating from processes launched by the Velociraptor client service shortly after artifact collection events.

Upgrade Velociraptor to version 0.77.3 or later, which enforces the EXECVE required permission on the Windows.Sysinternals.SysmonLogForward artifact and extends permission verification to all client event artifacts (GitHub Advisory, Velociraptor Advisory). As an interim workaround, restrict the COLLECT_CLIENT permission and the Investigator role to only fully trusted users, and audit existing role assignments to minimize exposure. Additionally, consider reviewing and restricting which artifacts are available for collection by Investigator-role users until the patch is applied.