Vulnerability · Published Dec 18, 2025 · Assigned by cisa-cg

CVE-2025-62001BullWall Ransomware Containment hard-coded folder exclusions

High 8.8

In plain English

A high-severity security flaw in Ransomware Containment from BullWall. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.4%top 70.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

BullWall Ransomware Containment supports configurable file and directory exclusions such as '$RECYCLE.BIN' to balance monitoring scope and performance. Certain exclusion patterns could allow an authenticated attacker to rename directories in a way that avoids monitoring. Fixed in 4.6.1.14 and 5.0.0.42, which remove hardcoded exclusion behavior and exposes exclusion handling as configurable settings.

Affected products (as reported)

Vendor	Product	Versions
BullWall	Ransomware Containment	4.6.0.0 – before 4.6.1.144.6.0.0 – before 5.0.0.42

Weakness: CWE-420 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

url government-resource, third-party-advisory
url vdb-entry