Privilege escalation in Velociraptor via SysmonLogForward artifact
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
Velociraptor from 0 before 0.77.3 lets users with COLLECT_CLIENT permission, typically granted by the Investigator role, run arbitrary binaries on endpoints. The Windows.Sysinternals.SysmonLogForward monitoring artifact accepts an arbitrary binary path as a parameter and does not require an additional elevated permission such as EXECVE. An attacker who already has the ability to collect artifacts from an endpoint can run a different program than the installed Sysmon binary, which is a privilege escalation (CWE-276). The attack requires the attacker to already hold artifact collection rights on the endpoint.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usually run with elevated permissions. To limit access to some dangerous artifact, Velociraptor allows for those to require high permissions like EXECVE to launch. The `Windows.Sysinternals.SysmonLogForward` is a monitoring artifact used to forward sysmon events to the server. The artifact allows the user to specify an arbitrary binary path as a parameter, and did not enforce an additional required permission, allowing users with COLLECT_CLIENT permissions (normally given by the "Investigator" role) to collect it from endpoints and run a different binary program than the installed sysmon binary. To successfully exploit this vulnerability the user must already have access to collect artifacts from the endpoint (i.e. have the COLLECT_CLIENT given typically by the "Investigator" role).
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
Upgrade Velociraptor to version 0.77.3 or later, which fixes the issue.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · CNA Velociraptor (Rapid7) Fixed in 0.77.3
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Rapid7 Velociraptor 0.77.3
3 records Highest priority Priority LOW 3 LOW
Other records, highest priority first
- TI-2026-67776 Velociraptor permission check lets label users change server metadataPriority LOW 28
- TI-2026-67761 Rapid7 Velociraptor WatchEvent API leaks events across organizationsPriority LOW 22
Timeline
- 2026-10-05 Threatist record created from CVE-2026-78413
- 2026-10-05 Alias added: GHSA-9q45-6cc2-4qjv
- 2026-10-05 CISA SSVC decision points changed
- 2026-10-05 Priority changed: MEDIUM → LOW
References
More Rapid7 vulnerabilities
- TI-2023-01233 Rapid7 InsightCloudSec resource.db() method access CVSS 3.1HIGH 8.8
- TI-2023-01231 Rapid7 InsightCloudSec getattr() method access CVSS 3.1HIGH 8.8
- TI-2023-01232 Rapid7 InsightCloudSec box object access CVSS 3.1HIGH 8.1
- TI-2024-00358 Rapid7 Minerva Armor Privilege Escalation CVSS 3.1HIGH 7.8
- TI-2024-02985 Rapid7 Insight Agent Sensitive Key Exposed To Local Users CVSS 3.1MEDIUM 6.8
- TI-2019-04008 Rapid7 Metasploit HTTP Handler Denial of Service CVSS 3.1HIGH 7.5
Sources
- CVE-2026-78413 · CVE Program
- CVE-2026-78413 · NVD
- FIRST EPSS
- GHSA-9q45-6cc2-4qjv · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences