CVE-2026-78413: Velociraptor Privilege Escalation Vulnerability

CVE-2026-78413 Overview

CVE-2026-78413 is an improper permissions vulnerability [CWE-276] in Velociraptor, an open-source endpoint monitoring and digital forensics platform. The Windows.Sysinternals.SysmonLogForward artifact accepts an arbitrary binary path as a parameter but does not enforce an additional required permission such as EXECVE. A user with the COLLECT_CLIENT permission, typically granted by the built-in Investigator role, can collect the artifact from endpoints and execute an attacker-controlled binary instead of the installed sysmon binary. Exploitation requires existing authenticated access to collect artifacts from endpoints, which limits the attack surface to users already inside the Velociraptor deployment.

Critical Impact
An authenticated Investigator-role user can execute arbitrary binaries on managed endpoints by abusing the Windows.Sysinternals.SysmonLogForward monitoring artifact.

Affected Products

Velociraptor endpoint monitoring and digital forensics server
Deployments exposing the Windows.Sysinternals.SysmonLogForward client event artifact
Environments granting the Investigator role (which includes COLLECT_CLIENT) to lower-trust users

Discovery Timeline

2026-10-05 - CVE-2026-78413 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-78413

Vulnerability Analysis

Velociraptor uses the VQL (Velociraptor Query Language) packaged into Artifacts to collect data and run instrumentation on endpoints. Dangerous artifacts can be gated behind elevated permissions such as EXECVE to prevent abuse by lower-privileged users. The Windows.Sysinternals.SysmonLogForward artifact is a client event (monitoring) artifact used to forward Sysmon events to the server. It exposes a parameter that accepts an arbitrary path to the Sysmon binary. The artifact definition did not declare the elevated permission required to run arbitrary executables. As a result, Velociraptor's permission check allowed a user with only COLLECT_CLIENT to deploy the artifact and point it at any binary on the target endpoint.

Root Cause

The root cause is a missing permission declaration on a client event artifact that invokes a user-supplied binary path. The artifact verifier used by the server did not cover client event artifacts, so the required-permission metadata was never evaluated against the artifact's actual behavior.

Attack Vector

A user with the Investigator role (or any role that grants COLLECT_CLIENT) selects the Windows.Sysinternals.SysmonLogForward artifact in a client collection and sets the binary path parameter to an attacker-chosen executable already present on the endpoint. The Velociraptor client launches the specified binary with the elevated privileges normally used for Sysmon forwarding, bypassing the EXECVE permission requirement.

// Patch excerpt: api/artifacts.go - add client event artifacts to the artifact verifier
	artifact string) (*launcher.AnalysisState, error) {

	state := launcher.NewAnalysisState(artifact)
+	defer state.Done()
+
	manager, err := services.GetRepositoryManager(config_obj)
	if err != nil {
		return nil, err

Source: Velocidex GitHub Commit 7906c82

// Patch excerpt: api/replication.go - use the correct org config for server->server calls
		return err
	}

+	// The call can access the datastore from any org because it is a
+	// server->server call.
+	org_manager, err := services.GetOrgManager()
+	if err != nil {
+		return err
+	}
+
+	// Use the org config
+	config_obj, err = org_manager.GetOrgConfig(in.OrgId)
+	if err != nil {
+		return err
+	}
+
	// This name is taken from the certificate usually
	// VelociraptorServer.
	peer_name := user_record.Name

Source: Velocidex GitHub Commit 7906c82

Detection Methods for CVE-2026-78413

Indicators of Compromise

Velociraptor audit log entries showing collection of Windows.Sysinternals.SysmonLogForward by non-administrator users.
Client event monitoring collections where the Sysmon binary path parameter points to a path other than the installed Sysmon executable.
Child processes launched by the Velociraptor client agent that do not match the expected Sysmon binary signature or path.

Detection Strategies

Hunt in the Velociraptor server audit log for collect_client actions targeting client event artifacts, especially Windows.Sysinternals.SysmonLogForward.
Correlate parameter values for the Sysmon binary path with an allow-list of expected paths and hashes.
Monitor endpoints for processes spawned by the Velociraptor service that are not signed by Microsoft or installed in the approved Sysinternals directory.

Monitoring Recommendations

Enable and centrally forward Velociraptor server audit logs to a SIEM for role-based access review.
Track changes to role assignments that grant COLLECT_CLIENT, especially the Investigator role.
Alert on execution of unexpected binaries under the Velociraptor client process tree on managed endpoints.

How to Mitigate CVE-2026-78413

Immediate Actions Required

Upgrade Velociraptor to a version containing commit 7906c82fad728010f2fe1d0555b99dbaba3ce88f, which adds client event artifacts to the artifact verifier.
Review and reduce assignment of the Investigator role and any custom role granting COLLECT_CLIENT.
Audit historical collections of Windows.Sysinternals.SysmonLogForward for suspicious binary path parameters.

Patch Information

The fix is published in the upstream Velocidex repository. The patch extends the artifact verifier to cover client event artifacts and ensures that artifacts invoking arbitrary binaries require the appropriate elevated permission. See the Velociraptor Advisory for CVE-2026-78413 and the Velocidex GitHub Commit Details for full technical context.

Workarounds

Restrict the Windows.Sysinternals.SysmonLogForward artifact to administrators by requiring EXECVE in a local override of the artifact definition until patched.
Remove COLLECT_CLIENT from any role that does not strictly require endpoint collection capabilities.
Implement endpoint application control to allow only the signed Sysmon binary at its expected path to run under the Velociraptor client.

bash

# Example: pin an allow-listed Sysmon binary path and verify integrity before upgrade
expected_hash="<sha256-of-trusted-sysmon.exe>"
actual_hash=$(sha256sum "C:/Program Files/Sysinternals/Sysmon64.exe" | awk '{print $1}')
[ "$expected_hash" = "$actual_hash" ] || echo "Sysmon binary mismatch - investigate"