{"schema_version":"2","view":"grouped","data":[{"id":8912,"cve_ids":["CVE-2026-78413"],"payload":{"kind":"advisory","title":"Velociraptor privilege escalation via SysmonLogForward client monitoring artifact","summary":"Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usually run with elevated permissions. To limit access to some dangerous artifact, Velociraptor allows for those to require high permissions like EXECVE to launch. The `Windows.Sysinternals.SysmonLogForward` is a monitoring artifact used to forward sysmon events to the server. The artifact allows the user to specify an arbitrary binary path as a parameter, and did not enforce an additional required permission, allowing users with COLLECT_CLIENT permissions (normally given by the \"Investigator\" role) to collect it from endpoints and run a different binary program than the installed sysmon binary. To successfully exploit this vulnerability the user must already have access to collect artifacts from the endpoint (i.e. have the COLLECT_CLIENT given typically by the \"Investigator\" role).","evidence":"cve:CVE-2026-78413","products":[{"name":{"value":"Velociraptor","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-78413","aliases":["CVE-2026-78413"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":5.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"LOW","privilegesRequired":"HIGH","confidentialityImpact":"LOW"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/Velocidex/velociraptor/","vendor":"Rapid7","product":"Velociraptor","versions":[{"status":"affected","version":"0","lessThan":"0.77.3","versionType":"semver"}],"platforms":["Linux"],"packageName":"Velociraptor","defaultStatus":"unaffected"}],"modified":"2026-10-05T19:07:47.590Z","provider":"cve","references":["https://github.com/Velocidex/velociraptor/commit/7906c82fad728010f2fe1d0555b99dbaba3ce88f"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-78413","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-05T19:07:38.053928Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-05T19:07:47.590Z"}}],"cna":{"orgId":"9974b330-7714-4307-a722-5648477acda7","shortName":"rapid7","dateUpdated":"2026-10-05T17:48:03.883Z"}}},"related_cves":[{"value":"CVE-2026-78413","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:1706323a-ccee-4c29-a21c-9b405ae62893","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-78413","advisory_id":"1706323a-ccee-4c29-a21c-9b405ae62893","event_types":["advisory"],"published_at":"2026-10-24T23:08:21.130406+00:00","technologies":["core-cve","velociraptor"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T17:48:03.883+00:00","detail_url":"/advisories/advisory%3A1706323a-ccee-4c29-a21c-9b405ae62893","group":{"id":"advisory:1706323a-ccee-4c29-a21c-9b405ae62893","revision":1,"primary_event_id":8898,"change":"published","superseded_by":[],"changed":{"id":8898,"cve_ids":["CVE-2026-78413"],"payload":{"kind":"advisory","title":"Velociraptor privilege escalation via SysmonLogForward client monitoring artifact","summary":"Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usually run with elevated permissions. To limit access to some dangerous artifact, Velociraptor allows for those to require high permissions like EXECVE to launch. The `Windows.Sysinternals.SysmonLogForward` is a monitoring artifact used to forward sysmon events to the server. The artifact allows the user to specify an arbitrary binary path as a parameter, and did not enforce an additional required permission, allowing users with COLLECT_CLIENT permissions (normally given by the \"Investigator\" role) to collect it from endpoints and run a different binary program than the installed sysmon binary. To successfully exploit this vulnerability the user must already have access to collect artifacts from the endpoint (i.e. have the COLLECT_CLIENT given typically by the \"Investigator\" role).","evidence":"cve:CVE-2026-78413","products":[{"name":{"value":"Velociraptor","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-78413","aliases":["CVE-2026-78413"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":5.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"LOW","privilegesRequired":"HIGH","confidentialityImpact":"LOW"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/Velocidex/velociraptor/","vendor":"Rapid7","product":"Velociraptor","versions":[{"status":"affected","version":"0","lessThan":"0.77.3","versionType":"semver"}],"platforms":["Linux"],"packageName":"Velociraptor","defaultStatus":"unaffected"}],"modified":"2026-10-05T19:07:47.590Z","provider":"cve","references":["https://github.com/Velocidex/velociraptor/commit/7906c82fad728010f2fe1d0555b99dbaba3ce88f"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-78413","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-05T19:07:38.053928Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-05T19:07:47.590Z"}}],"cna":{"orgId":"9974b330-7714-4307-a722-5648477acda7","shortName":"rapid7","dateUpdated":"2026-10-05T17:48:03.883Z"}}},"related_cves":[{"value":"CVE-2026-78413","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:1706323a-ccee-4c29-a21c-9b405ae62893","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-78413","advisory_id":"1706323a-ccee-4c29-a21c-9b405ae62893","event_types":["advisory"],"published_at":"2026-10-24T23:08:21.130406+00:00","technologies":["core-cve","velociraptor"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T17:48:03.883+00:00","detail_url":"/events/8898"},"members":[{"id":8898,"cve_ids":["CVE-2026-78413"],"payload":{"kind":"advisory","title":"Velociraptor privilege escalation via SysmonLogForward client monitoring artifact","summary":"Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usually run with elevated permissions. To limit access to some dangerous artifact, Velociraptor allows for those to require high permissions like EXECVE to launch. The `Windows.Sysinternals.SysmonLogForward` is a monitoring artifact used to forward sysmon events to the server. The artifact allows the user to specify an arbitrary binary path as a parameter, and did not enforce an additional required permission, allowing users with COLLECT_CLIENT permissions (normally given by the \"Investigator\" role) to collect it from endpoints and run a different binary program than the installed sysmon binary. To successfully exploit this vulnerability the user must already have access to collect artifacts from the endpoint (i.e. have the COLLECT_CLIENT given typically by the \"Investigator\" role).","evidence":"cve:CVE-2026-78413","products":[{"name":{"value":"Velociraptor","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-78413","aliases":["CVE-2026-78413"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":5.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"LOW","privilegesRequired":"HIGH","confidentialityImpact":"LOW"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/Velocidex/velociraptor/","vendor":"Rapid7","product":"Velociraptor","versions":[{"status":"affected","version":"0","lessThan":"0.77.3","versionType":"semver"}],"platforms":["Linux"],"packageName":"Velociraptor","defaultStatus":"unaffected"}],"modified":"2026-10-05T19:07:47.590Z","provider":"cve","references":["https://github.com/Velocidex/velociraptor/commit/7906c82fad728010f2fe1d0555b99dbaba3ce88f"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-78413","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-05T19:07:38.053928Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-05T19:07:47.590Z"}}],"cna":{"orgId":"9974b330-7714-4307-a722-5648477acda7","shortName":"rapid7","dateUpdated":"2026-10-05T17:48:03.883Z"}}},"related_cves":[{"value":"CVE-2026-78413","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:1706323a-ccee-4c29-a21c-9b405ae62893","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-78413","advisory_id":"1706323a-ccee-4c29-a21c-9b405ae62893","event_types":["advisory"],"published_at":"2026-10-24T23:08:21.130406+00:00","technologies":["core-cve","velociraptor"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T17:48:03.883+00:00","detail_url":"/events/8898"}]}},{"id":8911,"cve_ids":["CVE-2026-78412"],"payload":{"kind":"advisory","title":"WatchEvent API streams another organization's live events","summary":"Velociraptor's WatchEvent gRPC API can specify the OrgId of the org from which events should be streamed. The server checks the API permissions against the caller's Org instead of the requested Org. This allows a user with API access in one org to read events from another org for which they have no access.","evidence":"cve:CVE-2026-78412","products":[{"name":{"value":"Velociraptor","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-78412","aliases":["CVE-2026-78412"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/Velocidex/velociraptor/","vendor":"Rapid7","product":"Velociraptor","versions":[{"status":"affected","version":"0","lessThan":"0.77.3","versionType":"semver"}],"platforms":["Linux"],"packageName":"Velociraptor","defaultStatus":"unaffected"}],"modified":"2026-10-05T19:04:43.517Z","provider":"cve","references":[],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-78412","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-05T19:04:33.376171Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-05T19:04:43.517Z"}}],"cna":{"orgId":"9974b330-7714-4307-a722-5648477acda7","shortName":"rapid7","dateUpdated":"2026-10-05T16:54:07.484Z"}}},"related_cves":[{"value":"CVE-2026-78412","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:2b32a750-00dd-434a-9598-9959431d9f2c","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-78412","advisory_id":"2b32a750-00dd-434a-9598-9959431d9f2c","event_types":["advisory"],"published_at":"2026-10-24T23:08:20.809975+00:00","technologies":["core-cve","velociraptor"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T16:51:34.797+00:00","detail_url":"/advisories/advisory%3A2b32a750-00dd-434a-9598-9959431d9f2c","group":{"id":"advisory:2b32a750-00dd-434a-9598-9959431d9f2c","revision":1,"primary_event_id":8897,"change":"published","superseded_by":[],"changed":{"id":8897,"cve_ids":["CVE-2026-78412"],"payload":{"kind":"advisory","title":"WatchEvent API streams another organization's live events","summary":"Velociraptor's WatchEvent gRPC API can specify the OrgId of the org from which events should be streamed. The server checks the API permissions against the caller's Org instead of the requested Org. This allows a user with API access in one org to read events from another org for which they have no access.","evidence":"cve:CVE-2026-78412","products":[{"name":{"value":"Velociraptor","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-78412","aliases":["CVE-2026-78412"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/Velocidex/velociraptor/","vendor":"Rapid7","product":"Velociraptor","versions":[{"status":"affected","version":"0","lessThan":"0.77.3","versionType":"semver"}],"platforms":["Linux"],"packageName":"Velociraptor","defaultStatus":"unaffected"}],"modified":"2026-10-05T19:04:43.517Z","provider":"cve","references":[],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-78412","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-05T19:04:33.376171Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-05T19:04:43.517Z"}}],"cna":{"orgId":"9974b330-7714-4307-a722-5648477acda7","shortName":"rapid7","dateUpdated":"2026-10-05T16:54:07.484Z"}}},"related_cves":[{"value":"CVE-2026-78412","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:2b32a750-00dd-434a-9598-9959431d9f2c","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-78412","advisory_id":"2b32a750-00dd-434a-9598-9959431d9f2c","event_types":["advisory"],"published_at":"2026-10-24T23:08:20.809975+00:00","technologies":["core-cve","velociraptor"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T16:51:34.797+00:00","detail_url":"/events/8897"},"members":[{"id":8897,"cve_ids":["CVE-2026-78412"],"payload":{"kind":"advisory","title":"WatchEvent API streams another organization's live events","summary":"Velociraptor's WatchEvent gRPC API can specify the OrgId of the org from which events should be streamed. The server checks the API permissions against the caller's Org instead of the requested Org. This allows a user with API access in one org to read events from another org for which they have no access.","evidence":"cve:CVE-2026-78412","products":[{"name":{"value":"Velociraptor","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-78412","aliases":["CVE-2026-78412"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/Velocidex/velociraptor/","vendor":"Rapid7","product":"Velociraptor","versions":[{"status":"affected","version":"0","lessThan":"0.77.3","versionType":"semver"}],"platforms":["Linux"],"packageName":"Velociraptor","defaultStatus":"unaffected"}],"modified":"2026-10-05T19:04:43.517Z","provider":"cve","references":[],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-78412","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-05T19:04:33.376171Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-05T19:04:43.517Z"}}],"cna":{"orgId":"9974b330-7714-4307-a722-5648477acda7","shortName":"rapid7","dateUpdated":"2026-10-05T16:54:07.484Z"}}},"related_cves":[{"value":"CVE-2026-78412","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:2b32a750-00dd-434a-9598-9959431d9f2c","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-78412","advisory_id":"2b32a750-00dd-434a-9598-9959431d9f2c","event_types":["advisory"],"published_at":"2026-10-24T23:08:20.809975+00:00","technologies":["core-cve","velociraptor"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T16:51:34.797+00:00","detail_url":"/events/8897"}]}},{"id":8910,"cve_ids":["CVE-2026-78411"],"payload":{"kind":"advisory","title":"Velociraptor Server Metadata update with Insufficient Permission Check","summary":"Velociraptor's SetClientMetadata used the wrong permission check to enforce setting metadata on the server. This allows a user with LABEL_CLIENTS permission to update the server metadata. Server metadata is often used to store site wide configuration data that should only be updated by the server admin.","evidence":"cve:CVE-2026-78411","products":[{"name":{"value":"Velociraptor","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-78411","aliases":["CVE-2026-78411"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"NONE"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/Velocidex/velociraptor/","vendor":"Rapid7","product":"Velociraptor","versions":[{"status":"affected","version":"0","lessThan":"0.77.3","versionType":"semver"}],"platforms":["Linux"],"packageName":"Velociraptor","defaultStatus":"unaffected"}],"modified":"2026-10-05T19:05:02.257Z","provider":"cve","references":[],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-78411","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-05T19:04:54.631828Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-05T19:05:02.257Z"}}],"cna":{"orgId":"9974b330-7714-4307-a722-5648477acda7","shortName":"rapid7","dateUpdated":"2026-10-05T17:19:26.340Z"}}},"related_cves":[{"value":"CVE-2026-78411","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:58be7a55-94af-464d-b092-9962aa3d78c9","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-78411","advisory_id":"58be7a55-94af-464d-b092-9962aa3d78c9","event_types":["advisory"],"published_at":"2026-10-24T23:08:20.48952+00:00","technologies":["core-cve","velociraptor"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T17:19:26.34+00:00","detail_url":"/advisories/advisory%3A58be7a55-94af-464d-b092-9962aa3d78c9","group":{"id":"advisory:58be7a55-94af-464d-b092-9962aa3d78c9","revision":1,"primary_event_id":8896,"change":"published","superseded_by":[],"changed":{"id":8896,"cve_ids":["CVE-2026-78411"],"payload":{"kind":"advisory","title":"Velociraptor Server Metadata update with Insufficient Permission Check","summary":"Velociraptor's SetClientMetadata used the wrong permission check to enforce setting metadata on the server. This allows a user with LABEL_CLIENTS permission to update the server metadata. Server metadata is often used to store site wide configuration data that should only be updated by the server admin.","evidence":"cve:CVE-2026-78411","products":[{"name":{"value":"Velociraptor","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-78411","aliases":["CVE-2026-78411"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"NONE"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/Velocidex/velociraptor/","vendor":"Rapid7","product":"Velociraptor","versions":[{"status":"affected","version":"0","lessThan":"0.77.3","versionType":"semver"}],"platforms":["Linux"],"packageName":"Velociraptor","defaultStatus":"unaffected"}],"modified":"2026-10-05T19:05:02.257Z","provider":"cve","references":[],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-78411","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-05T19:04:54.631828Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-05T19:05:02.257Z"}}],"cna":{"orgId":"9974b330-7714-4307-a722-5648477acda7","shortName":"rapid7","dateUpdated":"2026-10-05T17:19:26.340Z"}}},"related_cves":[{"value":"CVE-2026-78411","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:58be7a55-94af-464d-b092-9962aa3d78c9","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-78411","advisory_id":"58be7a55-94af-464d-b092-9962aa3d78c9","event_types":["advisory"],"published_at":"2026-10-24T23:08:20.48952+00:00","technologies":["core-cve","velociraptor"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T17:19:26.34+00:00","detail_url":"/events/8896"},"members":[{"id":8896,"cve_ids":["CVE-2026-78411"],"payload":{"kind":"advisory","title":"Velociraptor Server Metadata update with Insufficient Permission Check","summary":"Velociraptor's SetClientMetadata used the wrong permission check to enforce setting metadata on the server. This allows a user with LABEL_CLIENTS permission to update the server metadata. Server metadata is often used to store site wide configuration data that should only be updated by the server admin.","evidence":"cve:CVE-2026-78411","products":[{"name":{"value":"Velociraptor","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-78411","aliases":["CVE-2026-78411"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"NONE"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/Velocidex/velociraptor/","vendor":"Rapid7","product":"Velociraptor","versions":[{"status":"affected","version":"0","lessThan":"0.77.3","versionType":"semver"}],"platforms":["Linux"],"packageName":"Velociraptor","defaultStatus":"unaffected"}],"modified":"2026-10-05T19:05:02.257Z","provider":"cve","references":[],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-78411","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-05T19:04:54.631828Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-05T19:05:02.257Z"}}],"cna":{"orgId":"9974b330-7714-4307-a722-5648477acda7","shortName":"rapid7","dateUpdated":"2026-10-05T17:19:26.340Z"}}},"related_cves":[{"value":"CVE-2026-78411","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:58be7a55-94af-464d-b092-9962aa3d78c9","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-78411","advisory_id":"58be7a55-94af-464d-b092-9962aa3d78c9","event_types":["advisory"],"published_at":"2026-10-24T23:08:20.48952+00:00","technologies":["core-cve","velociraptor"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T17:19:26.34+00:00","detail_url":"/events/8896"}]}},{"id":3407,"cve_ids":["CVE-2026-77797"],"payload":{"kind":"advisory","title":"Velociraptor Prefetch parser out of bounds","summary":"Velociraptor's prefetch library contains an out of bound vulnerability which may cause a crash when parsing certain malformed prefetch files.","evidence":"cve:CVE-2026-77797","products":[{"name":{"value":"Velociraptor","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","structured":{"id":"CVE-2026-77797","aliases":["CVE-2026-77797"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":3.6,"attackVector":"LOCAL","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"NONE"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/Velocidex/velociraptor/","vendor":"Rapid7","product":"Velociraptor","versions":[{"status":"affected","version":"0","lessThan":"0.77.3","versionType":"semver"}],"platforms":["Windows"],"packageName":"Velociraptor","defaultStatus":"unaffected"}],"modified":"2026-09-29T10:39:07.525Z","provider":"cve","references":["https://github.com/Velocidex/go-prefetch/commit/4bae9796298011598d577b125e0b3db3ee03eb74"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-77797","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-24T14:47:47.888267Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T14:47:56.068Z"}}],"cna":{"orgId":"9974b330-7714-4307-a722-5648477acda7","shortName":"rapid7","dateUpdated":"2026-09-29T10:39:07.525Z"}}},"related_cves":[{"value":"CVE-2026-77797","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:185fc6c0-7961-4508-8b64-1f4d13a7e677","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-77797","advisory_id":"185fc6c0-7961-4508-8b64-1f4d13a7e677","event_types":["advisory"],"published_at":"2026-10-24T21:35:24.311857+00:00","technologies":["core-cve","velociraptor"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-24T13:49:41.379+00:00","detail_url":"/advisories/advisory%3A185fc6c0-7961-4508-8b64-1f4d13a7e677","group":{"id":"advisory:185fc6c0-7961-4508-8b64-1f4d13a7e677","revision":1,"primary_event_id":3425,"change":"published","superseded_by":[],"changed":{"id":3425,"cve_ids":["CVE-2026-77797"],"payload":{"kind":"advisory","title":"Velociraptor Prefetch parser out of bounds","summary":"Velociraptor's prefetch library contains an out of bound vulnerability which may cause a crash when parsing certain malformed prefetch files.","evidence":"cve:CVE-2026-77797","products":[{"name":{"value":"Velociraptor","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","structured":{"id":"CVE-2026-77797","aliases":["CVE-2026-77797"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":3.6,"attackVector":"LOCAL","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"NONE"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/Velocidex/velociraptor/","vendor":"Rapid7","product":"Velociraptor","versions":[{"status":"affected","version":"0","lessThan":"0.77.3","versionType":"semver"}],"platforms":["Windows"],"packageName":"Velociraptor","defaultStatus":"unaffected"}],"modified":"2026-09-29T10:39:07.525Z","provider":"cve","references":["https://github.com/Velocidex/go-prefetch/commit/4bae9796298011598d577b125e0b3db3ee03eb74"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-77797","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-24T14:47:47.888267Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T14:47:56.068Z"}}],"cna":{"orgId":"9974b330-7714-4307-a722-5648477acda7","shortName":"rapid7","dateUpdated":"2026-09-29T10:39:07.525Z"}}},"related_cves":[{"value":"CVE-2026-77797","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:185fc6c0-7961-4508-8b64-1f4d13a7e677","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-77797","advisory_id":"185fc6c0-7961-4508-8b64-1f4d13a7e677","event_types":["advisory"],"published_at":"2026-10-24T21:35:24.311857+00:00","technologies":["core-cve","velociraptor"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-24T13:49:41.379+00:00","detail_url":"/events/3425"},"members":[{"id":3425,"cve_ids":["CVE-2026-77797"],"payload":{"kind":"advisory","title":"Velociraptor Prefetch parser out of bounds","summary":"Velociraptor's prefetch library contains an out of bound vulnerability which may cause a crash when parsing certain malformed prefetch files.","evidence":"cve:CVE-2026-77797","products":[{"name":{"value":"Velociraptor","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","structured":{"id":"CVE-2026-77797","aliases":["CVE-2026-77797"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":3.6,"attackVector":"LOCAL","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"NONE"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/Velocidex/velociraptor/","vendor":"Rapid7","product":"Velociraptor","versions":[{"status":"affected","version":"0","lessThan":"0.77.3","versionType":"semver"}],"platforms":["Windows"],"packageName":"Velociraptor","defaultStatus":"unaffected"}],"modified":"2026-09-29T10:39:07.525Z","provider":"cve","references":["https://github.com/Velocidex/go-prefetch/commit/4bae9796298011598d577b125e0b3db3ee03eb74"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-77797","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-24T14:47:47.888267Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T14:47:56.068Z"}}],"cna":{"orgId":"9974b330-7714-4307-a722-5648477acda7","shortName":"rapid7","dateUpdated":"2026-09-29T10:39:07.525Z"}}},"related_cves":[{"value":"CVE-2026-77797","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:185fc6c0-7961-4508-8b64-1f4d13a7e677","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-77797","advisory_id":"185fc6c0-7961-4508-8b64-1f4d13a7e677","event_types":["advisory"],"published_at":"2026-10-24T21:35:24.311857+00:00","technologies":["core-cve","velociraptor"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-24T13:49:41.379+00:00","detail_url":"/events/3425"}]}},{"id":1981,"cve_ids":["CVE-2026-19072"],"payload":{"kind":"advisory","title":"Velociraptor Investigator reaches SuperUser via hunt EffectivePrincipal","summary":"Velociraptor stores the compiled VQL in the hunt object internally to avoid having to recompile the artifacts for each endpoint in the hunt. Although the field \"compiled_collector_args\" is an internal field, Velociraptor allowed the field to be set from a user API call. This allows another user who can schedule a hunt (minimal role of \"investigator\" ) to set the compiled VQL statements for the hunt bypassing any ACL checks that would normally be applied. This flaw can then be escalated to allow the \"investigator\" user to run arbitrary VQL statements as an administrator user on the Velociraptor server.","evidence":"cve:CVE-2026-19072","products":[{"name":{"value":"Velociraptor","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-19072","aliases":["CVE-2026-19072"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":9.9,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/Velocidex/velociraptor/","vendor":"Rapid7","product":"Velociraptor","versions":[{"status":"affected","version":"0","lessThan":"0.77.2","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-09-25T03:55:27.705Z","provider":"cve","references":["https://docs.velociraptor.app/announcements/advisories/cve-2026-19072/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-19072","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-24T00:00:00+00:00"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-25T03:55:27.705Z"}}],"cna":{"orgId":"9974b330-7714-4307-a722-5648477acda7","shortName":"rapid7","dateUpdated":"2026-09-24T12:52:51.864Z"}}},"related_cves":[{"value":"CVE-2026-19072","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:f44c7890-2d96-45b7-bbfa-ad72c113cd42","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-19072","advisory_id":"f44c7890-2d96-45b7-bbfa-ad72c113cd42","event_types":["advisory"],"published_at":"2026-10-24T21:11:02.084191+00:00","technologies":["core-cve","velociraptor"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-24T12:52:51.864+00:00","detail_url":"/advisories/advisory%3Af44c7890-2d96-45b7-bbfa-ad72c113cd42","group":{"id":"advisory:f44c7890-2d96-45b7-bbfa-ad72c113cd42","revision":1,"primary_event_id":1980,"change":"published","superseded_by":[],"changed":{"id":1980,"cve_ids":["CVE-2026-19072"],"payload":{"kind":"advisory","title":"Velociraptor Investigator reaches SuperUser via hunt EffectivePrincipal","summary":"Velociraptor stores the compiled VQL in the hunt object internally to avoid having to recompile the artifacts for each endpoint in the hunt. Although the field \"compiled_collector_args\" is an internal field, Velociraptor allowed the field to be set from a user API call. This allows another user who can schedule a hunt (minimal role of \"investigator\" ) to set the compiled VQL statements for the hunt bypassing any ACL checks that would normally be applied. This flaw can then be escalated to allow the \"investigator\" user to run arbitrary VQL statements as an administrator user on the Velociraptor server.","evidence":"cve:CVE-2026-19072","products":[{"name":{"value":"Velociraptor","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-19072","aliases":["CVE-2026-19072"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":9.9,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/Velocidex/velociraptor/","vendor":"Rapid7","product":"Velociraptor","versions":[{"status":"affected","version":"0","lessThan":"0.77.2","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-09-25T03:55:27.705Z","provider":"cve","references":["https://docs.velociraptor.app/announcements/advisories/cve-2026-19072/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-19072","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-24T00:00:00+00:00"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-25T03:55:27.705Z"}}],"cna":{"orgId":"9974b330-7714-4307-a722-5648477acda7","shortName":"rapid7","dateUpdated":"2026-09-24T12:52:51.864Z"}}},"related_cves":[{"value":"CVE-2026-19072","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:f44c7890-2d96-45b7-bbfa-ad72c113cd42","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-19072","advisory_id":"f44c7890-2d96-45b7-bbfa-ad72c113cd42","event_types":["advisory"],"published_at":"2026-10-24T21:11:02.084191+00:00","technologies":["core-cve","velociraptor"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-24T12:52:51.864+00:00","detail_url":"/events/1980"},"members":[{"id":1980,"cve_ids":["CVE-2026-19072"],"payload":{"kind":"advisory","title":"Velociraptor Investigator reaches SuperUser via hunt EffectivePrincipal","summary":"Velociraptor stores the compiled VQL in the hunt object internally to avoid having to recompile the artifacts for each endpoint in the hunt. Although the field \"compiled_collector_args\" is an internal field, Velociraptor allowed the field to be set from a user API call. This allows another user who can schedule a hunt (minimal role of \"investigator\" ) to set the compiled VQL statements for the hunt bypassing any ACL checks that would normally be applied. This flaw can then be escalated to allow the \"investigator\" user to run arbitrary VQL statements as an administrator user on the Velociraptor server.","evidence":"cve:CVE-2026-19072","products":[{"name":{"value":"Velociraptor","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-19072","aliases":["CVE-2026-19072"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":9.9,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/Velocidex/velociraptor/","vendor":"Rapid7","product":"Velociraptor","versions":[{"status":"affected","version":"0","lessThan":"0.77.2","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-09-25T03:55:27.705Z","provider":"cve","references":["https://docs.velociraptor.app/announcements/advisories/cve-2026-19072/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-19072","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-24T00:00:00+00:00"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-25T03:55:27.705Z"}}],"cna":{"orgId":"9974b330-7714-4307-a722-5648477acda7","shortName":"rapid7","dateUpdated":"2026-09-24T12:52:51.864Z"}}},"related_cves":[{"value":"CVE-2026-19072","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:f44c7890-2d96-45b7-bbfa-ad72c113cd42","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-19072","advisory_id":"f44c7890-2d96-45b7-bbfa-ad72c113cd42","event_types":["advisory"],"published_at":"2026-10-24T21:11:02.084191+00:00","technologies":["core-cve","velociraptor"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-24T12:52:51.864+00:00","detail_url":"/events/1980"}]}},{"id":1750,"cve_ids":["CVE-2026-77798"],"payload":{"kind":"advisory","title":"Velociraptor Authenticated Denial of Service","summary":"Velociraptor contains a deadlock condition that may be triggered by authenticated users. The issue stems from a lock management bug in the user management module.","evidence":"cve:CVE-2026-77798","products":[{"name":{"value":"Velociraptor","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-77798","aliases":["CVE-2026-77798"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"NONE"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/Velocidex/velociraptor/","vendor":"Rapid7","product":"Velociraptor","versions":[{"status":"affected","version":"0","lessThan":"0.77.2","versionType":"semver"}],"platforms":["Linux"],"packageName":"Velociraptor","defaultStatus":"unaffected"}],"modified":"2026-09-24T14:48:39.415Z","provider":"cve","references":["https://github.com/Velocidex/velociraptor/commit/b64d915422da2e8366781bea2b5c5e6808df829c"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-77798","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-24T14:48:32.322715Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T14:48:39.415Z"}}],"cna":{"orgId":"9974b330-7714-4307-a722-5648477acda7","shortName":"rapid7","dateUpdated":"2026-09-24T13:50:40.310Z"}}},"related_cves":[{"value":"CVE-2026-77798","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:cfd55302-23e4-41e7-bbcb-a0038532c779","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-77798","advisory_id":"cfd55302-23e4-41e7-bbcb-a0038532c779","event_types":["advisory"],"published_at":"2026-10-24T21:06:26.660163+00:00","technologies":["core-cve","velociraptor"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-24T13:50:40.31+00:00","detail_url":"/advisories/advisory%3Acfd55302-23e4-41e7-bbcb-a0038532c779","group":{"id":"advisory:cfd55302-23e4-41e7-bbcb-a0038532c779","revision":1,"primary_event_id":1734,"change":"published","superseded_by":[],"changed":{"id":1734,"cve_ids":["CVE-2026-77798"],"payload":{"kind":"advisory","title":"Velociraptor Authenticated Denial of Service","summary":"Velociraptor contains a deadlock condition that may be triggered by authenticated users. The issue stems from a lock management bug in the user management module.","evidence":"cve:CVE-2026-77798","products":[{"name":{"value":"Velociraptor","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-77798","aliases":["CVE-2026-77798"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"NONE"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/Velocidex/velociraptor/","vendor":"Rapid7","product":"Velociraptor","versions":[{"status":"affected","version":"0","lessThan":"0.77.2","versionType":"semver"}],"platforms":["Linux"],"packageName":"Velociraptor","defaultStatus":"unaffected"}],"modified":"2026-09-24T14:48:39.415Z","provider":"cve","references":["https://github.com/Velocidex/velociraptor/commit/b64d915422da2e8366781bea2b5c5e6808df829c"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-77798","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-24T14:48:32.322715Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T14:48:39.415Z"}}],"cna":{"orgId":"9974b330-7714-4307-a722-5648477acda7","shortName":"rapid7","dateUpdated":"2026-09-24T13:50:40.310Z"}}},"related_cves":[{"value":"CVE-2026-77798","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:cfd55302-23e4-41e7-bbcb-a0038532c779","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-77798","advisory_id":"cfd55302-23e4-41e7-bbcb-a0038532c779","event_types":["advisory"],"published_at":"2026-10-24T21:06:26.660163+00:00","technologies":["core-cve","velociraptor"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-24T13:50:40.31+00:00","detail_url":"/events/1734"},"members":[{"id":1734,"cve_ids":["CVE-2026-77798"],"payload":{"kind":"advisory","title":"Velociraptor Authenticated Denial of Service","summary":"Velociraptor contains a deadlock condition that may be triggered by authenticated users. The issue stems from a lock management bug in the user management module.","evidence":"cve:CVE-2026-77798","products":[{"name":{"value":"Velociraptor","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-77798","aliases":["CVE-2026-77798"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"NONE"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/Velocidex/velociraptor/","vendor":"Rapid7","product":"Velociraptor","versions":[{"status":"affected","version":"0","lessThan":"0.77.2","versionType":"semver"}],"platforms":["Linux"],"packageName":"Velociraptor","defaultStatus":"unaffected"}],"modified":"2026-09-24T14:48:39.415Z","provider":"cve","references":["https://github.com/Velocidex/velociraptor/commit/b64d915422da2e8366781bea2b5c5e6808df829c"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-77798","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-24T14:48:32.322715Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T14:48:39.415Z"}}],"cna":{"orgId":"9974b330-7714-4307-a722-5648477acda7","shortName":"rapid7","dateUpdated":"2026-09-24T13:50:40.310Z"}}},"related_cves":[{"value":"CVE-2026-77798","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:cfd55302-23e4-41e7-bbcb-a0038532c779","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-77798","advisory_id":"cfd55302-23e4-41e7-bbcb-a0038532c779","event_types":["advisory"],"published_at":"2026-10-24T21:06:26.660163+00:00","technologies":["core-cve","velociraptor"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-24T13:50:40.31+00:00","detail_url":"/events/1734"}]}}],"next_after":8912,"next_before":1750}