Velociraptor EUVD-2026-75233

The attacker must be an authenticated Velociraptor user who already holds the permission/role to schedule or edit client monitoring artifacts (the client event table) - this is the only prerequisite and matches PR:L. Exploitation does NOT require the EXECVE permission (that is precisely the missing check), does not require user interaction, and works against default configurations of unpatched servers. Limiting factors: it is not pre-authentication (a valid low-privileged account with monitoring-edit rights is required), and environments that already restrict client-monitoring editing to trusted admins have effectively no additional exposed population beyond those admins.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C, 9.9) reflects a network-reachable server, low attack complexity, an authenticated but low-privileged actor, no user interaction, and a scope change - the compromised server authority is used to execute code on separate client endpoints, which justifies the near-maximal score. PR:L is the key limiter: the attacker must already be an authenticated Velociraptor user holding the ability to schedule client monitoring artifacts (e.g. an 'investigator'-style role), so this is an insider/least-privilege-containment failure rather than a pre-auth internet exploit. EPSS, KEV, and SSVC data were not provided; there is no evidence of active exploitation, so this should be prioritized on impact (fleet-wide arbitrary command execution) rather than on demonstrated in-the-wild activity. The provided 'Information Disclosure' tag understates the risk - the real primary impact is privilege escalation leading to remote code execution on every managed endpoint.

A low-privileged Velociraptor user with the ability to edit client monitoring - for example an investigator who should only be able to run gated collections with approval - adds the Linux.Sys.BashShell artifact (or an equivalent command-runner) to the client event table without holding EXECVE. The server distributes the monitoring rule to the fleet, and the embedded commands execute on every affected endpoint, giving the insider hands-on-keyboard code execution across the estate. No public exploit is identified, but the change is trivial to perform through the normal UI/API once the user has monitoring-edit rights.