CVE-2025-62002: BullWall Ransomware Containment file count detection bypass

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-12-18 · updated 2026-06-17
Weakness: CWE-358

Description

BullWall Ransomware Containment considers the number of files modified to trigger detection. An authenticated attacker could encrypt a single (possibly large) file without triggering detection if thresholds are configured to require multiple file changes. The number of files to trigger detection can be configured by the user. Versions 4.6.0.0, 4.6.0.6, 4.6.0.7, and 4.6.1.4 are affected. Other versions may also be affected.

Affected products

BullWall Ransomware Containment: 4.6.0.0, 4.6.0.6, 4.6.0.7, 4.6.1.4

References

https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-352-01.json
https://www.cve.org/CVERecord?id=CVE-2025-62002

Get alerted when CVE-2025-62002 or the next vulnerability affects your stack