{"schema":"vulnpedia.research/1","cve":"CVE-2025-6264","references":[{"url":"https://docs.velociraptor.app/announcements/advisories/cve-2025-6264/","tags":["Mitigation","Vendor Advisory"],"source":"mitre","sourceId":"rapid7","modified":"2025-06-22T23:23:30.800Z","origins":[{"source":"mitre","sourceId":"rapid7","modified":"2025-06-22T23:23:30.800Z","url":"https://docs.velociraptor.app/announcements/advisories/cve-2025-6264/"},{"source":"nvd","sourceId":"CVE-2025-6264","modified":"2026-06-17T10:01:29.023","url":"https://docs.velociraptor.app/announcements/advisories/cve-2025-6264/"}]},{"url":"https://blog.talosintelligence.com/velociraptor-leveraged-in-ransomware-attacks/","tags":["Exploit","Third Party Advisory"],"source":"mitre","sourceId":"CISA-ADP","modified":"2025-11-28T19:10:18.293Z","origins":[{"source":"mitre","sourceId":"CISA-ADP","modified":"2025-11-28T19:10:18.293Z","url":"https://blog.talosintelligence.com/velociraptor-leveraged-in-ransomware-attacks/"},{"source":"nvd","sourceId":"CVE-2025-6264","modified":"2026-06-17T10:01:29.023","url":"https://blog.talosintelligence.com/velociraptor-leveraged-in-ransomware-attacks/"}]},{"url":"https://news.sophos.com/en-us/2025/08/26/velociraptor-incident-response-tool-abused-for-remote-access/","tags":["Exploit","Third Party Advisory"],"source":"mitre","sourceId":"CISA-ADP","modified":"2025-11-28T19:10:18.293Z","origins":[{"source":"mitre","sourceId":"CISA-ADP","modified":"2025-11-28T19:10:18.293Z","url":"https://news.sophos.com/en-us/2025/08/26/velociraptor-incident-response-tool-abused-for-remote-access/"},{"source":"nvd","sourceId":"CVE-2025-6264","modified":"2026-06-17T10:01:29.023","url":"https://news.sophos.com/en-us/2025/08/26/velociraptor-incident-response-tool-abused-for-remote-access/"}]},{"url":"https://osv.dev/vulnerability/GHSA-gpfc-mph4-qm24","tags":["ADVISORY"],"source":"ghsa","sourceId":"GHSA-gpfc-mph4-qm24","modified":"2025-10-13T15:45:55Z","origins":[{"source":"ghsa","sourceId":"GHSA-gpfc-mph4-qm24","url":"https://osv.dev/vulnerability/GHSA-gpfc-mph4-qm24"},{"source":"ghsa","sourceId":"GHSA-gpfc-mph4-qm24","modified":"2025-10-13T15:45:55Z","url":"https://osv.dev/vulnerability/GHSA-gpfc-mph4-qm24"}]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-6264","tags":["ADVISORY"],"source":"ghsa","sourceId":"GHSA-gpfc-mph4-qm24","modified":"2025-10-13T15:45:55Z","origins":[{"source":"ghsa","sourceId":"GHSA-gpfc-mph4-qm24","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-6264"},{"source":"go","sourceId":"GO-2025-3768","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-6264"},{"source":"ghsa","sourceId":"GHSA-gpfc-mph4-qm24","modified":"2025-10-13T15:45:55Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-6264"}]},{"url":"https://github.com/Velocidex/velociraptor/commit/21e7fd7138ddaa798cad35fd929864f6bb0c4e9c","tags":["WEB"],"source":"ghsa","sourceId":"GHSA-gpfc-mph4-qm24","modified":"2025-10-13T15:45:55Z","origins":[{"source":"ghsa","sourceId":"GHSA-gpfc-mph4-qm24","url":"https://github.com/Velocidex/velociraptor/commit/21e7fd7138ddaa798cad35fd929864f6bb0c4e9c"},{"source":"go","sourceId":"GO-2025-3768","url":"https://github.com/Velocidex/velociraptor/commit/21e7fd7138ddaa798cad35fd929864f6bb0c4e9c"},{"source":"ghsa","sourceId":"GHSA-gpfc-mph4-qm24","modified":"2025-10-13T15:45:55Z","url":"https://github.com/Velocidex/velociraptor/commit/21e7fd7138ddaa798cad35fd929864f6bb0c4e9c"}]},{"url":"https://blog.talosintelligence.com/velociraptor-leveraged-in-ransomware-attacks","tags":["WEB"],"source":"ghsa","sourceId":"GHSA-gpfc-mph4-qm24","modified":"2025-10-13T15:45:55Z","origins":[{"source":"ghsa","sourceId":"GHSA-gpfc-mph4-qm24","url":"https://blog.talosintelligence.com/velociraptor-leveraged-in-ransomware-attacks"},{"source":"ghsa","sourceId":"GHSA-gpfc-mph4-qm24","modified":"2025-10-13T15:45:55Z","url":"https://blog.talosintelligence.com/velociraptor-leveraged-in-ransomware-attacks"}]},{"url":"https://docs.velociraptor.app/announcements/advisories/cve-2025-6264","tags":["WEB"],"source":"ghsa","sourceId":"GHSA-gpfc-mph4-qm24","modified":"2025-10-13T15:45:55Z","origins":[{"source":"ghsa","sourceId":"GHSA-gpfc-mph4-qm24","url":"https://docs.velociraptor.app/announcements/advisories/cve-2025-6264"},{"source":"go","sourceId":"GO-2025-3768","url":"https://docs.velociraptor.app/announcements/advisories/cve-2025-6264"},{"source":"ghsa","sourceId":"GHSA-gpfc-mph4-qm24","modified":"2025-10-13T15:45:55Z","url":"https://docs.velociraptor.app/announcements/advisories/cve-2025-6264"}]},{"url":"https://github.com/Velocidex/velociraptor","tags":["PACKAGE"],"source":"ghsa","sourceId":"GHSA-gpfc-mph4-qm24","modified":"2025-10-13T15:45:55Z","origins":[{"source":"ghsa","sourceId":"GHSA-gpfc-mph4-qm24","url":"https://github.com/Velocidex/velociraptor"},{"source":"ghsa","sourceId":"GHSA-gpfc-mph4-qm24","modified":"2025-10-13T15:45:55Z","url":"https://github.com/Velocidex/velociraptor"}]},{"url":"https://news.sophos.com/en-us/2025/08/26/velociraptor-incident-response-tool-abused-for-remote-access","tags":["WEB"],"source":"ghsa","sourceId":"GHSA-gpfc-mph4-qm24","modified":"2025-10-13T15:45:55Z","origins":[{"source":"ghsa","sourceId":"GHSA-gpfc-mph4-qm24","url":"https://news.sophos.com/en-us/2025/08/26/velociraptor-incident-response-tool-abused-for-remote-access"},{"source":"ghsa","sourceId":"GHSA-gpfc-mph4-qm24","modified":"2025-10-13T15:45:55Z","url":"https://news.sophos.com/en-us/2025/08/26/velociraptor-incident-response-tool-abused-for-remote-access"}]},{"url":"https://osv.dev/vulnerability/GO-2025-3768","tags":["ADVISORY"],"source":"go","sourceId":"GO-2025-3768","modified":"2026-03-03T04:56:41.341853Z","origins":[{"source":"go","sourceId":"GO-2025-3768","url":"https://osv.dev/vulnerability/GO-2025-3768"},{"source":"go","sourceId":"GO-2025-3768","modified":"2026-03-03T04:56:41.341853Z","url":"https://osv.dev/vulnerability/GO-2025-3768"}]},{"url":"https://github.com/advisories/GHSA-gpfc-mph4-qm24","tags":["ADVISORY"],"source":"go","sourceId":"GO-2025-3768","modified":"2026-03-03T04:56:41.341853Z","origins":[{"source":"go","sourceId":"GO-2025-3768","url":"https://github.com/advisories/GHSA-gpfc-mph4-qm24"},{"source":"go","sourceId":"GO-2025-3768","modified":"2026-03-03T04:56:41.341853Z","url":"https://github.com/advisories/GHSA-gpfc-mph4-qm24"}]},{"source":"euvd","sourceId":"EUVD-2025-18787","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-18787","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2025-18787","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-18787"}]},{"url":"https://vulncheck.com/kev","tags":["ADVISORY"],"source":"vulncheck-kev","sourceId":"CVE-2025-6264","modified":"2025-10-22T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-6264","modified":"2025-10-22T00:00:00Z","url":"https://vulncheck.com/kev"}]},{"url":"https://medium.com/@nshcthreatrecon/weekly-threat-intelligece-report-13-oct-2025-b33e60550f1d","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-6264","modified":"2025-10-22T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-6264","modified":"2025-10-22T00:00:00Z","url":"https://medium.com/@nshcthreatrecon/weekly-threat-intelligece-report-13-oct-2025-b33e60550f1d"}]},{"url":"https://blog.talosintelligence.com/ir-trends-q3-2025/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-6264","modified":"2025-10-22T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-6264","modified":"2025-10-22T00:00:00Z","url":"https://blog.talosintelligence.com/ir-trends-q3-2025/"}]},{"url":"https://www.darktrace.com/blog/wsus-exploited-darktraces-analysis-of-post-exploitation-activities-related-to-cve-2025-59287","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-6264","modified":"2025-10-22T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-6264","modified":"2025-10-22T00:00:00Z","url":"https://www.darktrace.com/blog/wsus-exploited-darktraces-analysis-of-post-exploitation-activities-related-to-cve-2025-59287"}]},{"url":"https://cyble.com/blog/ransomware-attacks-surge-october-2025/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-6264","modified":"2025-10-22T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-6264","modified":"2025-10-22T00:00:00Z","url":"https://cyble.com/blog/ransomware-attacks-surge-october-2025/"}]},{"url":"https://www.loginsoft.com/reports/annually/vulnerability-intelligence-report-2025","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-6264","modified":"2025-10-22T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-6264","modified":"2025-10-22T00:00:00Z","url":"https://www.loginsoft.com/reports/annually/vulnerability-intelligence-report-2025"}]},{"url":"https://a.storyblok.com/f/313778/x/52dec39251/securin_ransomware-index-report_2025.pdf","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-6264","modified":"2025-10-22T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-6264","modified":"2025-10-22T00:00:00Z","url":"https://a.storyblok.com/f/313778/x/52dec39251/securin_ransomware-index-report_2025.pdf"}]},{"url":"https://wwv.vulncheck.com/2026-vulncheck-exploit-intelligence-report","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-6264","modified":"2025-10-22T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-6264","modified":"2025-10-22T00:00:00Z","url":"https://wwv.vulncheck.com/2026-vulncheck-exploit-intelligence-report"}]},{"url":"https://medium.com/s2wlab-threat-intelligence/ransomware-landscape-in-h2-2025-statistics-and-key-issues-079ebd4fbbfa","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2025-6264","modified":"2025-10-22T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-6264","modified":"2025-10-22T00:00:00Z","url":"https://medium.com/s2wlab-threat-intelligence/ransomware-landscape-in-h2-2025-statistics-and-key-issues-079ebd4fbbfa"}]}],"packages":[{"source":"ghsa","sourceId":"GHSA-gpfc-mph4-qm24","url":"https://osv.dev/vulnerability/GHSA-gpfc-mph4-qm24","ecosystem":"Go","name":"www.velocidex.com/golang/velociraptor","purl":"pkg:golang/www.velocidex.com/golang/velociraptor","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.74.3"}]}],"databaseSpecific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-gpfc-mph4-qm24/GHSA-gpfc-mph4-qm24.json"},"modified":"2025-10-13T15:45:55Z","origins":[{"source":"ghsa","sourceId":"GHSA-gpfc-mph4-qm24","modified":"2025-10-13T15:45:55Z","url":"https://osv.dev/vulnerability/GHSA-gpfc-mph4-qm24"}]},{"source":"go","sourceId":"GO-2025-3768","url":"https://osv.dev/vulnerability/GO-2025-3768","ecosystem":"Go","name":"www.velocidex.com/golang/velociraptor","purl":"pkg:golang/www.velocidex.com/golang/velociraptor","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.74.3"}]}],"ecosystemSpecific":{},"databaseSpecific":{"source":"https://vuln.go.dev/ID/GO-2025-3768.json"},"modified":"2026-03-03T04:56:41.341853Z","origins":[{"source":"go","sourceId":"GO-2025-3768","modified":"2026-03-03T04:56:41.341853Z","url":"https://osv.dev/vulnerability/GO-2025-3768"}]}],"pocCandidates":[{"url":"https://github.com/Mauzy0x00/velociraptor_CVE-2025-6264_PoC","source":"poc-in-github","sourceId":"CVE-2025-6264","modified":"2026-05-05T20:28:06Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2025-6264","url":"https://github.com/Mauzy0x00/velociraptor_CVE-2025-6264_PoC"},{"source":"poc-in-github","sourceId":"CVE-2025-6264","modified":"2026-05-05T20:28:06Z","url":"https://github.com/Mauzy0x00/velociraptor_CVE-2025-6264_PoC"}],"tags":[]}],"cataloguedPoc":[],"vendorStatements":[],"exploitationSources":[{"source":"vulncheck-kev","sourceId":"CVE-2025-6264","catalog":"VulnCheck KEV","kind":"catalogue","url":"https://vulncheck.com/kev","dateAdded":"2025-10-22T00:00:00Z","modified":"2025-10-22T00:00:00Z","requiredAction":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","knownRansomwareCampaignUse":"Known","reportedByVulncheckCanaries":false,"vendorProject":"rapid7","product":"velociraptor","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-6264","modified":"2025-10-22T00:00:00Z","url":"https://vulncheck.com/kev"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-6264","catalog":"VulnCheck KEV","kind":"report","url":"https://medium.com/@nshcthreatrecon/weekly-threat-intelligece-report-13-oct-2025-b33e60550f1d","dateAdded":"2025-10-22T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-6264","url":"https://medium.com/@nshcthreatrecon/weekly-threat-intelligece-report-13-oct-2025-b33e60550f1d"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-6264","catalog":"VulnCheck KEV","kind":"report","url":"https://blog.talosintelligence.com/ir-trends-q3-2025/","dateAdded":"2025-10-23T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-6264","url":"https://blog.talosintelligence.com/ir-trends-q3-2025/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-6264","catalog":"VulnCheck KEV","kind":"report","url":"https://www.darktrace.com/blog/wsus-exploited-darktraces-analysis-of-post-exploitation-activities-related-to-cve-2025-59287","dateAdded":"2025-10-29T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-6264","url":"https://www.darktrace.com/blog/wsus-exploited-darktraces-analysis-of-post-exploitation-activities-related-to-cve-2025-59287"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-6264","catalog":"VulnCheck KEV","kind":"report","url":"https://cyble.com/blog/ransomware-attacks-surge-october-2025/","dateAdded":"2025-11-13T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-6264","url":"https://cyble.com/blog/ransomware-attacks-surge-october-2025/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-6264","catalog":"VulnCheck KEV","kind":"report","url":"https://www.loginsoft.com/reports/annually/vulnerability-intelligence-report-2025","dateAdded":"2026-01-20T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-6264","url":"https://www.loginsoft.com/reports/annually/vulnerability-intelligence-report-2025"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-6264","catalog":"VulnCheck KEV","kind":"report","url":"https://a.storyblok.com/f/313778/x/52dec39251/securin_ransomware-index-report_2025.pdf","dateAdded":"2026-02-17T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-6264","url":"https://a.storyblok.com/f/313778/x/52dec39251/securin_ransomware-index-report_2025.pdf"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-6264","catalog":"VulnCheck KEV","kind":"report","url":"https://wwv.vulncheck.com/2026-vulncheck-exploit-intelligence-report","dateAdded":"2026-02-25T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-6264","url":"https://wwv.vulncheck.com/2026-vulncheck-exploit-intelligence-report"}]},{"source":"vulncheck-kev","sourceId":"CVE-2025-6264","catalog":"VulnCheck KEV","kind":"report","url":"https://medium.com/s2wlab-threat-intelligence/ransomware-landscape-in-h2-2025-statistics-and-key-issues-079ebd4fbbfa","dateAdded":"2026-03-10T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2025-6264","url":"https://medium.com/s2wlab-threat-intelligence/ransomware-landscape-in-h2-2025-statistics-and-key-issues-079ebd4fbbfa"}]}]}