CISA Alerts on Rapid7 Velociraptor Flaw Exploited in Ransomware Campaigns

According to CISA, the Cybersecurity and Infrastructure Security Agency, a critical vulnerability in Rapid7 Velociraptor has been added to its Known Exploited Vulnerabilities catalogue, with active exploitation in ransomware campaigns. Tracked as CVE-2025-6264, the flaw was added on 14 October 2025, and federal agencies have until 4 November to implement the necessary security measures.

The vulnerability stems from incorrect default permissions in Rapid7 Velociraptor, enabling attackers to execute arbitrary commands and gain full control of compromised endpoints, and it is classified under CWE-276. Exploitation requires initial access to collect artifacts, but in real-world attacks this has not prevented active exploitation, and security researchers warn that the tool’s presence makes it attractive to ransomware operators seeking stealthier control.

CISA’s designation indicates multiple threat groups have incorporated the exploit into their attack chains, with guidance for affected organisations to apply mitigations per vendor instructions or Binding Operational Directive 22-01 guidance for cloud deployments. Organizations should review Velociraptor deployments for indicators of compromise and, if mitigations cannot be applied promptly, consider discontinuing use until security measures are in place.