Skip to content
CVE Tracker
Back

CVE-2026-78413

Velociraptor privilege escalation via SysmonLogForward client monitoring artifact

Medium5.5EPSS 0.16%
Published
Updated
Reserved
Assigned by
rapid7

Description

Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usually run with elevated permissions. To limit access to some dangerous artifact, Velociraptor allows for those to require high permissions like EXECVE to launch. The `Windows.Sysinternals.SysmonLogForward` is a monitoring artifact used to forward sysmon events to the server. The artifact allows the user to specify an arbitrary binary path as a parameter, and did not enforce an additional required permission, allowing users with COLLECT_CLIENT permissions (normally given by the "Investigator" role) to collect it from endpoints and run a different binary program than the installed sysmon binary. To successfully exploit this vulnerability the user must already have access to collect artifacts from the endpoint (i.e. have the COLLECT_CLIENT given typically by the "Investigator" role).

Scores

CVSS scores of CVE-2026-78413, by who scored it
Scored byCVSSScoreVector
rapid7CNA (assigner)3.1Medium5.5CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L
NVDNVD · Awaiting Analysis3.1Medium5.5CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L
EPSS (exploitation in 30 days)
0.16% · top 95% of all CVEs (3 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: partial
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.5.

Weakness

Affected products

References (2)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2026-78413 badge
[![CVE-2026-78413](https://trackcve.app/badge/CVE-2026-78413.svg)](https://trackcve.app/cve/CVE-2026-78413)

Record last updated .