CVE Explorer
CVE-2025-6264
Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usually run with elevated permissions. To limit access to some dangerous artifact, Velociraptor allows for those to require high permissions like EXECVE to launch.
The Admin.Client.UpdateClientConfig is an artifact used to update the client's configuration. This artifact did not enforce an additional required permission, allowing users with COLLECT_CLIENT permiss
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"defaultStatus":"unaffected","platforms":["Windows","MacOS","Linux"],"product":"Velociraptor","repo":"https://github.com/Velocidex/velociraptor","vendor":"Rapid7","versions":[{"lessThan":"0.74.3","status":"affected","version":"0","versionType":"semver"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:0bed1fe7d54fd964c918bd16f4d824bf2a02895e328da20ae9071b91a6d8debf · sha256:251d3a927a6264c7… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L","version":"3.1"},"metric_type":"cvssV3_1"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:0bed1fe7d54fd964c918bd16f4d824bf2a02895e328da20ae9071b91a6d8debf · sha256:251d3a927a6264c7… · /containers/cna/metrics/0/cvssV3_1
CWE assertions
1 source assertion{"cweId":"CWE-276","description":"CWE-276 Incorrect Default Permissions","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:0bed1fe7d54fd964c918bd16f4d824bf2a02895e328da20ae9071b91a6d8debf · sha256:251d3a927a6264c7… · /containers/cna/problemTypes/0/descriptions/0
Source references
3 source assertions{"url":"https://blog.talosintelligence.com/velociraptor-leveraged-in-ransomware-attacks/"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:0bed1fe7d54fd964c918bd16f4d824bf2a02895e328da20ae9071b91a6d8debf · sha256:251d3a927a6264c7… · /containers/adp/0/references/0
{"url":"https://docs.velociraptor.app/announcements/advisories/cve-2025-6264/"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:0bed1fe7d54fd964c918bd16f4d824bf2a02895e328da20ae9071b91a6d8debf · sha256:251d3a927a6264c7… · /containers/cna/references/0
{"url":"https://news.sophos.com/en-us/2025/08/26/velociraptor-incident-response-tool-abused-for-remote-access/"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:0bed1fe7d54fd964c918bd16f4d824bf2a02895e328da20ae9071b91a6d8debf · sha256:251d3a927a6264c7… · /containers/adp/0/references/1
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.