Rapid7 Velociraptor vulnerability actively exploited in ransomware campaigns
Take action: If you're using Rapid7 Velociraptor endpoint forensics tool (versions up to 0.74.3), immediately upgrade to latest versions. Ransomware groups are actively exploiting it. Yes, there are prerequisites to the exploit, but some endpoint will be compromised eventually. Why leave the next door open for the attackers? After patching, review and restrict Velociraptor user permissions to least-privilege, implement the basic artifacts mechanism to control what artifacts can run, and rotate all credentials used for artifact collection.
Learn More
CISA is warning of active exploitation of a security vulnerability in Rapid7's Velociraptor endpoint forensics tool that allows attackers to execute arbitrary commands and take complete control of compromised endpoints.
This vulnerability is tracked as CVE-2025-6264 (CVSS score 5.5) and is caused by incorrect default permissions in the Admin.Client.UpdateClientConfig artifact, which is used to update client configurations and did not enforce additional required permissions, allowing users with COLLECT_CLIENT permissions (normally given by the "Investigator" role) to collect it from endpoints and update configurations.
Exploitation requires the attacker to already have access sufficient to collect artifacts from the endpoint. This prerequisite aligns with typical post-compromise scenarios where ransomware operators convert limited footholds into full control by abusing misconfigurations and elevated service contexts. The vulnerability transforms a legitimate forensics tool into a weapon for lateral movement and privilege escalation in compromised networks.
Despite being rated as medium severity, the vulnerability has been confirmed for use in ransomware campaigns, including those linked to LockBit and Conti variants. Security researchers at Mandiant reported instances where attackers used Velociraptor's own artifact-gathering features against defenders, injecting malicious payloads that evaded traditional detection.
According to Talos researchers, the vulnerability played a role in a campaign observed in August 2025, where threat actors deployed Warlock, LockBit, and Babuk ransomware to encrypt VMware ESXi virtual machines and Windows servers, severely impacting the customer's IT environment.
The vulnerability affects Velociraptor versions up to 0.74.3. Rapid7 has urged users to update to latest versions where stricter permission controls have been implemented. Federal agencies are required to remediate the vulnerability by November 4, 2025, per KEV timelines, or discontinue use if mitigations are unavailable.
To restrict the types of artifacts users can run, organizations should implement the basic artifacts mechanism and run the artifact verifier to detect unintended privilege escalations in custom artifacts. Teams should verify Velociraptor deployment permissions, rotate and least-privilege credentials tied to artifact collection, enforce strong role-based access controls and multi-factor authentication, and review agent trust and signing configurations.
