CVE-2026-78413: CWE-276 Incorrect default permissions in Rapid7 Velociraptor
Description
Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usually run with elevated permissions. To limit access to some dangerous artifact, Velociraptor allows for those to require high permissions like EXECVE to launch. The `Windows.Sysinternals.SysmonLogForward` is a monitoring artifact used to forward sysmon events to the server. The artifact allows the user to specify an arbitrary binary path as a parameter, and did not enforce an additional required permission, allowing users with COLLECT_CLIENT permissions (normally given by the "Investigator" role) to collect it from endpoints and run a different binary program than the installed sysmon binary. To successfully exploit this vulnerability the user must already have access to collect artifacts from the endpoint (i.e. have the COLLECT_CLIENT given typically by the "Investigator" role).
CVSS v3.1
Score 5.5medium
Affected software
Rapid7
Velociraptor
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Rapid7 Velociraptor versions prior to 0.77.3 contain a CWE-276 Incorrect Default Permissions vulnerability in the Windows.Sysinternals.SysmonLogForward artifact. This artifact forwards sysmon events to the server and allows specifying an arbitrary binary path as a parameter without enforcing the EXECVE permission requirement. Consequently, users with COLLECT_CLIENT permissions can run arbitrary binaries instead of the intended sysmon binary. Successful exploitation requires the user to already have artifact collection permissions on the endpoint.
Potential Impact
An attacker with COLLECT_CLIENT permissions can execute arbitrary binaries on the endpoint by abusing the SysmonLogForward artifact, potentially leading to limited confidentiality, integrity, and availability impacts. However, exploitation requires elevated privileges already granted by the Investigator role, limiting the scope of impact to users with existing access.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict assignment of COLLECT_CLIENT permissions to trusted users only and monitor for misuse of artifact collection capabilities.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- rapid7
- Date Reserved
- 2026-08-24T14:44:51.844Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ac3e69d2cdf04f65628b486
Added to database: 10/05/2026, 18:04:13 UTC
Last enriched: 10/05/2026, 18:18:52 UTC
Last updated: 10/05/2026, 21:24:50 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.