EUVD-2026-92536
GHSA-9q45-6cc2-4qjv
Severity by source
AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L
Attacker uses a privileged but non-admin Investigator role (PR:L) and simply overrides a parameter (AC:L); the server action runs an elevated arbitrary binary on a separate endpoint, so S:C with full endpoint code execution (C/I/A:H).
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (rapid7).
CVSS VectorVendor: rapid7
Lifecycle Timeline
4DescriptionCVE.org
Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usually run with elevated permissions. To limit access to some dangerous artifact, Velociraptor allows for those to require high permissions like EXECVE to launch.
The Windows.Sysinternals.SysmonLogForward is a monitoring artifact used to forward sysmon events to the server. The artifact allows the user to specify an arbitrary binary path as a parameter, and did not enforce an additional required permission, allowing users with COLLECT_CLIENT permissions (normally given by the "Investigator" role) to collect it from endpoints and run a different binary program than the installed sysmon binary. To successfully exploit this vulnerability the user must already have access to collect artifacts from the endpoint (i.e. have the COLLECT_CLIENT given typically by the "Investigator" role).
AnalysisAI
Privilege-model bypass in Rapid7 Velociraptor's Windows.Sysinternals.SysmonLogForward artifact allows an authenticated operator who holds only the COLLECT_CLIENT permission (typically the built-in 'Investigator' role) to launch an arbitrary, attacker-chosen binary on monitored Windows endpoints instead of the installed Sysmon binary. Because the artifact exposes a user-controllable binary-path parameter and fails to enforce the additional EXECVE permission that gates comparable dangerous artifacts, successful collection results in code execution on the endpoint under the elevated privileges the artifact normally runs with, yielding high confidentiality, integrity, and availability impact (assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated Velociraptor user who already holds the COLLECT_CLIENT permission (normally granted by the built-in 'Investigator' role) and the ability to collect artifacts from a target Windows endpoint running the sysmon/SysmonLogForward tooling. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a moderate, privilege-model-bypass issue rather than a mass-exploitation threat. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the upstream fix in commit 7906c82fad728010f2fe1d0555b99dbaba3ce88f and upgrade to the Velociraptor release that contains it; the vendor advisory at http://docs.velociraptor.app/announcements/advisories/cve-2026-78413 should be consulted for the exact patched version, which is not independently confirmed in the supplied data (upstream fix available via commit; released patched version not independently confirmed). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Same weakness CWE-276 – Incorrect Default Permissions
View allSame technique Privilege Escalation
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.0 | Not-Affected |
| SUSE Linux Enterprise Server 16.1 | Not-Affected |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Not-Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Not-Affected |
| openSUSE Leap 16.0 | Not-Affected |
Share
External POC / Exploit Code
Leaving vuln.today