TI-2025-17783 CVE-2025-24016 · GHSA-hcrc-79hj-m3qh
Remote code execution in Wazuh server
Priority CRITICAL 100KEV
Wazuh is a free and open source platform used for threat prevention, detection, and response.
Wazuh
Records102All Threatist records
Exploited (KEV)1In CISA KEV
CVSS critical15CVSS 9.0–10.0
CVSS high46CVSS 7.0–8.9
Exploited now
Wazuh records in CISA KEVComponents
Products in the NVD configurations · select one to filter the recordsRecords
102 records
TI-2026-47604 CVE-2026-67308 · GHSA-9chj-cp8j-3c5f
Wazuh GitHub Actions Shell Injection via Fork Pull Request
Priority HIGH 81
Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files.
Priority HIGH 77
Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wm_agent_upgrade that allows enrolled agents to issue upgrade_custom commands with attacker-controlled file_path.
Priority HIGH 76
Wazuh versions from 3.9.0 before 4.14.8 contain an arbitrary file overwrite vulnerability in MasterHandler.process_files_from_worker allowing a cluster worker to overwrite protected master files.
TI-2026-23722 CVE-2026-30893
Path traversal in wazuh
Priority HIGH 76
Wazuh is a free and open source platform used for threat prevention, detection, and response.
TI-2024-01157 CVE-2024-1243
Remote code execution and local privilege escalation in Wazuh Windows agent via NetNTLMv2 hash theft
Priority HIGH 76
Improper input validation in the Wazuh agent for Windows prior to version 4.8.0 allows an attacker with control over the Wazuh server or agent key to configure the agent to connect to a malicious UNC path.
TI-2026-22556 CVE-2026-28221
Wazuh: Pre-auth stack-based buffer overflow in wazuh-remoted print_hex_string() due to signed char promotion on x86_64
Priority HIGH 75
Wazuh is a free and open source platform used for threat prevention, detection, and response.
TI-2026-35598 CVE-2026-48162
Wazuh: cluster peer can read arbitrary master files and forge offline REST API…
Priority HIGH 74
Wazuh is a free and open source platform used for threat prevention, detection, and response.
TI-2026-35467 CVE-2026-48024
Wazuh: merged-file header path traversal in cluster sync allows arbitrary file write under WAZUH_PATH in Wazuh manager
Priority HIGH 74
Wazuh is a free and open source platform used for threat prevention, detection, and response.
TI-2026-22555 CVE-2026-28220
Deserialization of untrusted data in wazuh
Priority HIGH 74
Wazuh is a free and open source platform used for threat prevention, detection, and response.
Priority HIGH 74
Wazuh is a free and open source platform used for threat prevention, detection, and response.
TI-2026-20836 CVE-2026-25769
Wazuh Cluster vulnerable to Remote Code Execution via Insecure Deserialization
Priority HIGH 74
Wazuh is a free and open source platform used for threat prevention, detection, and response.
TI-2025-21537 CVE-2025-30201
Wazuh NetNTLMv2 Hash Theft In Multiple Centralized Configuration Capabilities
Priority HIGH 74
Wazuh is a free and open source platform used for threat prevention, detection, and response.
Priority HIGH 73
Wazuh dashboard plugins from 4.9.0 before 4.14.9 contain an authorization bypass vulnerability that allows authenticated dashboard users to override the Manager API Authorization header via the /api/request proxy endpoin…
TI-2023-27488 CVE-2023-50260
Wazuh's vulnerability in host_deny AR script allows arbitrary command execution
Priority HIGH 73
Wazuh is a free and open source platform used for threat prevention, detection, and response.
Priority HIGH 72
Wazuh 4.14.3 before 4.14.8 and 4.10.4 contains a case-sensitivity mismatch between the ossec.conf validator and wazuh-logcollector that bypasses remote-command validation.
Priority HIGH 72
Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for run_as users with zero static roles, because check_token never consults the blacklist.
Priority HIGH 72
Wazuh from 4.3.0 before 4.14.8 contains a remote code execution vulnerability where SCA policy trust is determined by file path rather than configuration source.
Priority HIGH 72
Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_lists() and delete_list_file() CDB list handlers that allows compromised cluster workers to read or delete master files.
TI-2026-50121 CVE-2026-71540
Wazuh Manager cluster header parsing allows pre-authentication memory exhaustion
Priority HIGH 72
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads.
TI-2026-33533 CVE-2026-45798
Stack-based buffer overflow in wazuh
Priority HIGH 72
Wazuh is a free and open source platform used for threat prevention, detection, and response.
TI-2026-32776 CVE-2026-44901
Wazuh Cluster DAPI Protocol Deserialization of Untrusted Data Remote Code Execution Vulnerability
Priority HIGH 72
Wazuh is a free and open source platform used for threat prevention, detection, and response.
Priority HIGH 72
Wazuh is a free and open source platform used for threat prevention, detection, and response.
TI-2026-26451 CVE-2026-34150
Wazuh: Heap buffer overflow in wazuh-analysisd via rootcheck event parsing
Priority HIGH 72
Wazuh is a free and open source platform used for threat prevention, detection, and response.
TI-2026-20838 CVE-2026-25771
Wazuh Vulnerable to Denial of Service via Synchronous I/O Blocking in Asynchronous Authentication Middleware
Priority HIGH 72
Wazuh is a free and open source platform used for threat prevention, detection, and response.