PT-2026-25922 · Wazuh · Wazuh
Skraft9
+1
·
Published
2026-03-17
·
Updated
2026-05-29
·
CVE-2026-25769
CVSS v3.1
9.1
Critical
| Vector | AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Wazuh versions 4.0.0 through 4.14.2
Description
Wazuh is a free and open source platform used for threat prevention, detection, and response. A Remote Code Execution (RCE) issue exists due to the deserialization of untrusted data within the cluster synchronization protocol. This affects deployments using cluster mode (master/worker architecture). An attacker who gains access to a worker node—via initial access, insider threats, or supply chain attacks—can achieve full RCE on the master node with root privileges by sending a specially crafted DAPI request. The issue involves the
as wazuh object() function, unsafe reflective object loading, and implicit cluster trust assumptions, allowing for Python runtime abuse and dynamic import exploitation.Recommendations
Update to version 4.14.3.
Exploit
Fix
LPE
RCE
Incorrect Permission
Path traversal
Improper Privilege Management
Deserialization of Untrusted Data
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Wazuh