Quick answers
- Is CVE-2026-78413 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-78413 being exploited in the wild.
- How severe is CVE-2026-78413?
- Medium severity, with a CVSS score of 5.5, published 5 October 2026.
- Which products and versions are affected?
- Velocidex Velociraptor before 0.77.3.
- Is there a fix for CVE-2026-78413?
- Yes: fixed in 0.77.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-78413 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-78413?
- Check whether you run Velocidex Velociraptor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 0.77.3
Technical details
The Windows.Sysinternals.SysmonLogForward artifact fails to enforce required_permissions on a user-controlled binary path parameter, allowing an authenticated user with COLLECT_CLIENT permissions to execute arbitrary code on managed endpoints. The artifact runs with elevated permissions but lacked the additional permission checks applied to other dangerous artifacts. An attacker must already have investigator-level access to the Velociraptor server to exploit this vulnerability.
Affected products
- Velocidex Velociraptor before 0.77.3
Timeline
- 2026-10-05: disclosed: CVE-2026-78413 published
- 2026-09-27: patched: Fix committed to repository (commit 7906c82)