{"metadata": {"vulnerability": "CVE-2025-6264", "count": 45, "kinds": {"milestone": 5, "sighting": 21, "kev": 5, "other": 14}}, "data": [{"timestamp": "2025-06-19T00:22:46.272Z", "date_only": false, "value": "2025-06-19T00:22:46.272Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2025-6264", "field": "cveMetadata.dateReserved"}, {"timestamp": "2025-06-19T00:44:00Z", "date_only": false, "value": "2025-06-19T00:44:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / rapid7", "record": "CVE-2025-6264", "field": "containers.cna.datePublic"}, {"timestamp": "2025-06-20T02:01:33.993Z", "date_only": false, "value": "2025-06-20T02:01:33.993Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2025-6264", "field": "cveMetadata.datePublished"}, {"timestamp": "2025-06-20T02:43:10Z", "date_only": false, "value": "2025-06-20T02:43:10.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/18894", "record": "CVE-2025-6264", "field": "creation_timestamp", "uuid": "71c2293b-1bff-4bfc-831f-3b5d2f1cb7da", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-6264\n\ud83d\udd25 CVSS Score: 4.7 (cvssV3_1, Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L)\n\ud83d\udd39 Description: Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usually run with elevated permissions.\u00a0 To limit access to some dangerous artifact, Velociraptor allows for those to require high permissions like EXECVE to launch.\n\nThe Admin.Client.UpdateClientConfig is an artifact used to update the client's configuration. This artifact did not enforce an additional required permission, allowing users with COLLECT_CLIENT permissions (normally given by the \"Investigator\" role) to collect it from endpoints and update the configuration. \n\nThis can lead to arbitrary command execution and endpoint takeover.\n\nTo successfully exploit this vulnerability the user must already have access to collect artifacts from the endpoint (i.e. have the COLLECT_CLIENT given typically by the \"Investigator' role).\n\ud83d\udccf Published: 2025-06-20T02:01:33.993Z\n\ud83d\udccf Modified: 2025-06-20T02:01:33.993Z\n\ud83d\udd17 References:\n1. https://docs.velociraptor.app/announcements/advisories/cve-2025-6264/", "url": "https://t.me/DarkWebInformer_CVEAlerts/18894"}, {"timestamp": "2025-06-20T03:15:27Z", "date_only": false, "value": "2025-06-20T03:15:27Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-GPFC-MPH4-QM24", "record": "GHSA-GPFC-MPH4-QM24", "field": "database_specific.nvd_published_at"}, {"timestamp": "2025-06-20T03:15:27.893Z", "date_only": false, "value": "2025-06-20T03:15:27.893", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-6264", "record": "FKIE_CVE-2025-6264", "field": "published"}, {"timestamp": "2025-06-20T03:30:32Z", "date_only": false, "value": "2025-06-20T03:30:32Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-GPFC-MPH4-QM24", "record": "GHSA-GPFC-MPH4-QM24", "field": "published"}, {"timestamp": "2025-06-20T03:44:14.764Z", "date_only": false, "value": "2025-06-20T03:44:14.764353Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lrz4qjqujj2k", "record": "CVE-2025-6264", "field": "creation_timestamp", "uuid": "0c1c5e9c-bf21-4bbd-ba54-634010b403ff", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/3lrz4qjqujj2k"}, {"timestamp": "2025-06-22T23:23:30.800Z", "date_only": false, "value": "2025-06-22T23:23:30.800Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / rapid7", "record": "CVE-2025-6264", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2025-08-04T00:00:00Z", "date_only": false, "value": "2025-08-04T00:00:00Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2025:15405-1", "record": "OPENSUSE-SU-2025:15405-1", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2025-08-04T00:00:00Z", "date_only": false, "value": "2025-08-04T00:00:00Z", "kind": "other", "label": "Date", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2025:15405-1", "record": "OPENSUSE-SU-2025:15405-1", "field": "vulnerabilities.0.threats.0.date"}, {"timestamp": "2025-08-04T00:00:00Z", "date_only": false, "value": "2025-08-04T00:00:00Z", "kind": "other", "label": "Document generated", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2025:15405-1", "record": "OPENSUSE-SU-2025:15405-1", "field": "document.tracking.generator.date"}, {"timestamp": "2025-08-04T00:00:00Z", "date_only": false, "value": "2025-08-04T00:00:00Z", "kind": "milestone", "label": "Published", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2025:15405-1", "record": "OPENSUSE-SU-2025:15405-1", "field": "document.tracking.initial_release_date"}, {"timestamp": "2025-10-09T12:00:02Z", "date_only": false, "value": "2025-10-09T12:00:02.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/Darkcrai86/98473e8b0105788f5f533d243d3436cc", "record": "CVE-2025-6264", "field": "creation_timestamp", "uuid": "3d837ccf-7d58-4c5f-8565-3245749c0416", "url": "https://gist.github.com/Darkcrai86/98473e8b0105788f5f533d243d3436cc"}, {"timestamp": "2025-10-09T19:28:19.772Z", "date_only": false, "value": "2025-10-09T19:28:19.772315Z", "kind": "sighting", "label": "Exploited", "source": "https://blog.talosintelligence.com/velociraptor-leveraged-in-ransomware-attacks/", "record": "CVE-2025-6264", "field": "creation_timestamp", "uuid": "7f7e754a-9322-44db-86a9-d17648d31f86", "url": "https://blog.talosintelligence.com/velociraptor-leveraged-in-ransomware-attacks/"}, {"timestamp": "2025-10-11T06:57:36.078Z", "date_only": false, "value": "2025-10-11T06:57:36.078077Z", "kind": "sighting", "label": "Seen", "source": "https://poliverso.org/objects/0477a01e-2b24c166-c09da0683257f1f7", "record": "CVE-2025-6264", "field": "creation_timestamp", "uuid": "23aa1292-8254-4211-8d6c-e497dba89a69", "url": "https://poliverso.org/objects/0477a01e-2b24c166-c09da0683257f1f7"}, {"timestamp": "2025-10-11T18:35:52Z", "date_only": false, "value": "2025-10-11T18:35:52.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/hackyourmom/12895", "record": "CVE-2025-6264", "field": "creation_timestamp", "uuid": "86658c1b-e61f-4747-8c65-e541f4fa1495", "content": "Storm-2603 (Gold Salem) \u043f\u0435\u0440\u0435\u0442\u0432\u043e\u0440\u0438\u0432 \u043b\u0435\u0433\u0430\u043b\u044c\u043d\u0438\u0439 DFIR-\u0456\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 Velociraptor \u043d\u0430 \u0437\u0430\u0441\u0456\u0431 \u043d\u0430\u043f\u0430\u0434\u0443, \u0432\u0438\u043a\u043e\u0440\u0438\u0441\u0442\u0430\u0432\u0448\u0438 \u0435\u043a\u0441\u043f\u043b\u043e\u0457\u0442 SharePoint ToolShell \u0434\u043b\u044f \u0432\u0445\u043e\u0434\u0443 \u0442\u0430 \u0437\u0430\u0441\u0442\u0430\u0440\u0456\u043b\u0443 \u0432\u0435\u0440\u0441\u0456\u044e Velociraptor \u0437 \u0443\u0440\u0430\u0437\u043b\u0438\u0432\u0456\u0441\u0442\u044e CVE-2025-6264 \u2328\ufe0f\n\n\ud83e\udde0 \u0417\u043b\u043e\u043c\u0438\u0441\u043d\u0438\u043a\u0438 \u0441\u0442\u0432\u043e\u0440\u044e\u0432\u0430\u043b\u0438 \u0434\u043e\u043c\u0435\u043d\u043d\u0456 \u0430\u0434\u043c\u0456\u043d\u0456\u0441\u0442\u0440\u0430\u0442\u0438\u0432\u043d\u0456 \u0430\u043a\u0430\u0443\u043d\u0442\u0438, \u0440\u0443\u0445\u0430\u043b\u0438\u0441\u044f \u0447\u0435\u0440\u0435\u0437 Smbexec, \u0432\u0438\u043c\u0438\u043a\u0430\u043b\u0438 \u0430\u043d\u0442\u0438\u0432\u0456\u0440\u0443\u0441 \u0456 \u0437\u043c\u0456\u043d\u044e\u0432\u0430\u043b\u0438 GPO \u0432 Active Directory, \u043e\u0434\u043d\u043e\u0447\u0430\u0441\u043d\u043e \u0440\u043e\u0437\u0433\u043e\u0440\u0442\u0430\u044e\u0447\u0438 Babuk, LockBit \u0456 Warlock, \u0449\u043e \u0443\u0441\u043a\u043b\u0430\u0434\u043d\u044e\u0432\u043b\u043e \u0430\u0442\u0440\u0438\u0431\u0443\u0446\u0456\u044e \ud83e\udd14\ud83d\udcbb #cybernews", "url": "https://t.me/hackyourmom/12895"}, {"timestamp": "2025-10-13T15:45:55Z", "date_only": false, "value": "2025-10-13T15:45:55Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-GPFC-MPH4-QM24", "record": "GHSA-GPFC-MPH4-QM24", "field": "modified"}, {"timestamp": "2025-10-14T17:36:15.934Z", "date_only": false, "value": "2025-10-14T17:36:15.934390Z", "kind": "sighting", "label": "Seen", "source": "https://feedsin.space/feed/CISAKevBot/items/4915843", "record": "CVE-2025-6264", "field": "creation_timestamp", "uuid": "cc50e23d-8255-4f9a-8b39-911710feaeed", "url": "https://feedsin.space/feed/CISAKevBot/items/4915843"}, {"timestamp": "2025-10-14T18:10:02Z", "date_only": false, "value": "2025-10-14T18:10:02.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "record": "CVE-2025-6264", "field": "creation_timestamp", "uuid": "d0f2915d-2825-41b5-8815-f86762e46418"}, {"timestamp": "2025-10-14T20:01:59.963Z", "date_only": false, "value": "2025-10-14T20:01:59.963446Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pigondrugs.bsky.social/post/3m36jhoi5o422", "record": "CVE-2025-6264", "field": "creation_timestamp", "uuid": "6e719468-651e-4ceb-9c39-7563571418aa", "url": "https://bsky.app/profile/pigondrugs.bsky.social/post/3m36jhoi5o422"}, {"timestamp": "2025-10-15T03:48:10Z", "date_only": false, "value": "2025-10-15T03:48:10.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "record": "CVE-2025-6264", "field": "creation_timestamp", "uuid": "51bfd1d3-b1d2-4731-95c9-dadf827bcdea"}, {"timestamp": "2025-10-15T17:05:34.911Z", "date_only": false, "value": "2025-10-15T17:05:34.911203Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/undercodenews.bsky.social/post/3m3aq34u7um2k", "record": "CVE-2025-6264", "field": "creation_timestamp", "uuid": "9ad1beb2-4768-4f53-b070-7e53f690bfb0", "url": "https://bsky.app/profile/undercodenews.bsky.social/post/3m3aq34u7um2k"}, {"timestamp": "2025-10-16T20:47:49.077Z", "date_only": false, "value": "2025-10-16T20:47:49.077950Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3m3dmxgmeyk2j", "record": "CVE-2025-6264", "field": "creation_timestamp", "uuid": "06fe4a94-6d9b-48cb-a145-607603057d47", "url": "https://bsky.app/profile/getpokemon7.bsky.social/post/3m3dmxgmeyk2j"}, {"timestamp": "2025-10-23T21:02:36.940Z", "date_only": false, "value": "2025-10-23T21:02:36.940812Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3m3vb25v3sy2a", "record": "CVE-2025-6264", "field": "creation_timestamp", "uuid": "2b33d803-49ec-40ae-8b9b-57d5dfb3179e", "url": "https://bsky.app/profile/beikokucyber.bsky.social/post/3m3vb25v3sy2a"}, {"timestamp": "2025-11-28T19:10:10.273Z", "date_only": false, "value": "2025-11-28T19:10:10.273114Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2025-6264", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2025-11-28T19:10:10.273Z", "date_only": false, "value": "2025-11-28T19:10:10.273114Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-6264", "record": "FKIE_CVE-2025-6264", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2025-11-28T19:10:18.293Z", "date_only": false, "value": "2025-11-28T19:10:18.293Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2025-6264", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2025-11-28T19:10:18.293Z", "date_only": false, "value": "2025-11-28T19:10:18.293Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2025-6264", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-06-01T10:42:11Z", "date_only": false, "value": "2026-06-01T10:42:11+00:00", "kind": "kev", "label": "Asserted", "source": "kevintel", "record": "CVE-2025-6264", "field": "timestamps.asserted_at", "uuid": "c6e1998c-27ff-4126-8982-b1f5a73f39ee", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-01T10:42:11Z", "date_only": false, "value": "2026-06-01T10:42:11+00:00", "kind": "kev", "label": "First seen", "source": "kevintel", "record": "CVE-2025-6264", "field": "timestamps.first_seen_at", "uuid": "c6e1998c-27ff-4126-8982-b1f5a73f39ee", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-01T10:42:11Z", "date_only": false, "value": "2026-06-01T10:42:11+00:00", "kind": "kev", "label": "Status updated", "source": "kevintel", "record": "CVE-2025-6264", "field": "status.status_updated_at", "uuid": "c6e1998c-27ff-4126-8982-b1f5a73f39ee", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-01T10:42:11.831Z", "date_only": false, "value": "2026-06-01T10:42:11.831Z", "kind": "kev", "label": "Catalog added", "source": "kevintel", "record": "CVE-2025-6264", "field": "evidence.0.details.added_date", "uuid": "c6e1998c-27ff-4126-8982-b1f5a73f39ee", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-17T10:01:29.023Z", "date_only": false, "value": "2026-06-17T10:01:29.023", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-6264", "record": "FKIE_CVE-2025-6264", "field": "lastModified"}, {"timestamp": "2026-06-19T12:41:46Z", "date_only": false, "value": "2026-06-19T12:41:46+00:00", "kind": "kev", "label": "Recorded", "source": "kevintel", "record": "CVE-2025-6264", "field": "timestamps.recorded_at", "uuid": "c6e1998c-27ff-4126-8982-b1f5a73f39ee", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-19T12:42:13.951Z", "date_only": false, "value": "2026-06-19T12:42:13.951252Z", "kind": "sighting", "label": "Exploited", "source": "https://db.gcve.eu/known-exploited-vulnerabilities-catalog/c6e1998c-27ff-4126-8982-b1f5a73f39ee", "record": "CVE-2025-6264", "field": "creation_timestamp", "uuid": "86a2044c-8bb2-4728-afb9-65a6af87b40a", "url": "https://db.gcve.eu/known-exploited-vulnerabilities-catalog/c6e1998c-27ff-4126-8982-b1f5a73f39ee"}, {"timestamp": "2026-06-19T12:45:24.179Z", "date_only": false, "value": "2026-06-19T12:45:24.179748Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/537eac92-0ba7-4334-9f8f-0d4ebe00a625", "record": "CVE-2025-6264", "field": "creation_timestamp", "uuid": "f3dd8010-8d04-4f2d-a190-84e2779e8385", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/537eac92-0ba7-4334-9f8f-0d4ebe00a625"}, {"timestamp": "2026-07-29T12:01:56.771Z", "date_only": false, "value": "2026-07-29T12:01:56.771879Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cyberdom_business/1717", "record": "CVE-2025-6264", "field": "creation_timestamp", "uuid": "fb5a786b-5be7-4836-9198-f0c38b66a30e", "url": "https://t.me/cyberdom_business/1717"}, {"timestamp": "2026-07-30T01:01:29.168Z", "date_only": false, "value": "2026-07-30T01:01:29.168751Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cyberdom_business/1717", "record": "CVE-2025-6264", "field": "creation_timestamp", "uuid": "5f180950-d3ba-40a5-833a-ddf954522b8b", "url": "https://t.me/cyberdom_business/1717"}, {"timestamp": "2026-08-01T19:00:03.865Z", "date_only": false, "value": "2026-08-01T19:00:03.865032Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/cyberdom_business/1717", "record": "CVE-2025-6264", "field": "creation_timestamp", "uuid": "c5cd43fa-7ebe-4153-9a01-25941459ac11", "url": "https://t.me/cyberdom_business/1717"}, {"timestamp": "2026-08-02T00:00:22.977Z", "date_only": false, "value": "2026-08-02T00:00:22.977689Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/cyberdom_business/1717", "record": "CVE-2025-6264", "field": "creation_timestamp", "uuid": "7fdbecec-6762-4fe2-86c9-3b240d38f5c3", "url": "https://t.me/cyberdom_business/1717"}, {"timestamp": "2026-08-29T23:00:12.797Z", "date_only": false, "value": "2026-08-29T23:00:12.797977Z", "kind": "sighting", "label": "Seen", "source": "Telegram/lHKFDBRntVLEnzL4VqEuPiY-Vt8pAa9hTd9KwEhxy_XdixQ", "record": "CVE-2025-6264", "field": "creation_timestamp", "uuid": "b00d0199-408f-4aca-88ee-af77b317cb2c"}, {"timestamp": "2026-08-31T00:00:45.979Z", "date_only": false, "value": "2026-08-31T00:00:45.979363Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/lHKFDBRntVLEnzL4VqEuPiY-Vt8pAa9hTd9KwEhxy_XdixQ", "record": "CVE-2025-6264", "field": "creation_timestamp", "uuid": "4b990e0e-8965-4db6-9502-de495c4e6999"}, {"timestamp": "2026-09-20T21:39:02Z", "date_only": false, "value": "2026-09-20T21:39:02Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2025:15405-1", "record": "OPENSUSE-SU-2025:15405-1", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-09-20T21:39:02Z", "date_only": false, "value": "2026-09-20T21:39:02Z", "kind": "other", "label": "Updated", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2025:15405-1", "record": "OPENSUSE-SU-2025:15405-1", "field": "document.tracking.current_release_date"}]}