CISA Warns Of Rapid7 Velociraptor Vulnerability Exploited in Ransomware Attacks

On Tue, Oct 14, 2025, the Cybersecurity and Infrastructure Security Agency (CISA) issued an urgent alert concerning a critical vulnerability in Rapid7's Velociraptor endpoint detection and response (EDR) tool. This flaw, identified by CVE-2025-6264, results from incorrect default permissions allowing threat actors to execute arbitrary commands and take control of affected endpoints. The vulnerability has been actively exploited in ransomware attacks, posing significant risks to organizations utilizing this open-source security platform.

The vulnerability arises from a misconfiguration that permits authenticated users with artifact collection privileges to escalate access. According to CISA's Known Exploited Vulnerabilities (KEV) catalog, exploitation requires initial endpoint access but can lead to a full system takeover. Velociraptor's forensic capabilities and artifact collection features have been manipulated by attackers to deploy malicious payloads while evading traditional detection systems.

Notably, ransomware groups, including those associated with LockBit and Conti variants, have utilized this vulnerability to expand from initial access points into broader network infections. An incident in late September 2025 resulted in a mid-sized financial firm losing endpoint visibility, leading to data exfiltration and encryption across 500 devices. This trend highlights the increasing focus on targeting security software itself, compromising tools like Velociraptor to neutralize defenses and gain reconnaissance advantages.

CISA recommends immediate application of Rapid7's patches, which introduce stricter permission controls in version 0.7.1 or later. Organizations are advised to enforce least-privilege access for artifact collection and follow Binding Operational Directive (BOD) 22-01 for cloud-based services. In cases where mitigation is not feasible, discontinuing use of the vulnerable product is advised. Federal agencies have been given a deadline of Tue, Nov 4, 2025, to address this vulnerability.

Security experts caution that this exploit underscores the potential configuration pitfalls of open-source tools. As ransomware techniques evolve, defenders must prioritize rigorous permission audits and maintain proactive monitoring. Rapid7 has provided detailed hardening guides, emphasizing the necessity of fortifying security tools amidst a 30% year-over-year increase in attacks.

Based on reporting by Cyber Security News.