PT-2025-26266 · Unknown · Velociraptor

Christian Fünfhaus · Published 2025-06-20 · Updated 2025-11-02 · CVE-2025-6264

Positive Technologies · (AI Summary)

CVSS v3.1

5.5

Medium

AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Velociraptor (affected versions not specified)

Description The issue concerns the Velociraptor's artifact collection feature, which allows users to collect and execute VQL queries packaged into artifacts from endpoints. These artifacts typically run with elevated permissions. A specific artifact, Admin.Client.UpdateClientConfig, used for updating the client's configuration, did not enforce an additional required permission. As a result, users with COLLECT CLIENT permissions, usually granted by the "Investigator" role, could collect this artifact from endpoints and update the configuration. This can lead to arbitrary command execution and endpoint takeover. To exploit this issue, the user must already have access to collect artifacts from the endpoint, typically granted by the "Investigator" role.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

LPE

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2025-6264

GHSA-GPFC-MPH4-QM24

GO-2025-3768

OPENSUSE-SU-2025:15405-1

Affected Products

Velociraptor

References · 95

• 🔥 https://news.sophos.com/en-us/2025/08/26/velociraptor-incident-response-tool-abused-for-remote-access · Exploit
• 🔥 https://blog.talosintelligence.com/velociraptor-leveraged-in-ransomware-attacks · Exploit
• https://osv.dev/vulnerability/openSUSE-SU-2025:15405-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-6264 · Security Note
• https://osv.dev/vulnerability/GO-2025-3768 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gpfc-mph4-qm24 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-6264 · Vendor Advisory
• https://github.com/Velocidex/velociraptor · Note
• https://github.com/Velocidex/velociraptor/commit/21e7fd7138ddaa798cad35fd929864f6bb0c4e9c · Note
• https://github.com/Cisco-Talos/IOCs · Note
• https://suse.com/security/cve/CVE-2025-53513 · Note
• https://suse.com/security/cve/CVE-2025-47281 · Note
• https://suse.com/security/cve/CVE-2024-44906 · Note
• https://suse.com/security/cve/CVE-2025-52997 · Note
• https://suse.com/security/cve/CVE-2025-4922 · Note