CVE-2025-6264
mediumpriority · track · 10OT risk · elevatedEPSS 0.010 · 64 %ileexploit · PoCEUUSEPSS · scored 2026-10-28
Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usually run with elevated permissions. To limit access to some dangerous artifact, Velociraptor allows for those to require high permissions like EXECVE to launch. The Admin.Client.UpdateClientConfig is an artifact used to update the client's configuration. This artifact did not enforce an additional required permission, allowing users with COLLECT_CLIENT permissions (normally given by the "Investigator" role) to collect it from endpoints and update the configuration. This can lead to arbitrary command execution and endpoint takeover. To successfully exploit this vulnerability the user must already have access to collect artifacts from the endpoint (i.e. have the COLLECT_CLIENT given typically by the "Investigator' role).
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
exploits (1)
Public proof-of-concept and weaponised exploit code.
affected products (3)
Products and version ranges known to be affected.
- Go www.velocidex.com/golang/velociraptor< 0.74.3osvUSpkg:golang/www.velocidex.com/golang/velociraptor
advisories (2)
Vendor and ecosystem advisories describing this.
- GHSA-gpfc-mph4-qm24Velociraptor vulnerable to privilege escalation via UpdateConfig artifact2025-06-20ghsa · osvUS
Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usually run with elevated permissions. To limit access to some dangerous artifact, Velociraptor allows for those to require high permissions like EXECVE to launch. The Admin.Client.UpdateClientConfig is an artifact used to update the client's configuration. This artifact did not enforce an additional required permission, allowing users with COLLECT_CLIENT permissions (normally given by the "Investigator" role) to collect it from endpoints and update the configuration. This can lead to arbitrary command execution and endpoint takeover. To successfully exploit this vulnerability the user must already have access to collect artifacts from the endpoint (i.e. have the COLLECT_CLIENT given typically by the "Investigator' role).
- GO-2025-3768Velociraptor vulnerable to privilege escalation via UpdateConfig artifact in www.velocidex.com/golang/velociraptor2025-07-28vendor · osvUS
Velociraptor vulnerable to privilege escalation via UpdateConfig artifact in www.velocidex.com/golang/velociraptor
also known as (5)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (6)
External citations — patches, advisories, analysis.
- https://docs.velociraptor.app/announcements/advisories/cve-2025-6264/cnnvd
- https://docs.velociraptor.app/downloads/Patchcnnvd
- https://docs.velociraptor.app/announcements/advisories/cve-2025-6264/enisa_euvd
- https://blog.talosintelligence.com/velociraptor-leveraged-in-ransomware-attacks/ExploitThird Party Advisorynvd
- https://docs.velociraptor.app/announcements/advisories/cve-2025-6264/MitigationVendor Advisorynvd
- https://news.sophos.com/en-us/2025/08/26/velociraptor-incident-response-tool-abused-for-remote-access/ExploitThird Party Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan