CVE-2026-25769
Last modified
CVE-2026-25769 is a critical-severity vulnerability rated 9.1/10 on the CVSS scale. Wazuh is a free and open source platform used for threat prevention, detection, and response. Versions 4.0.0 through 4.14.2 have a Remote Code Execution (RCE) vulnerability due to Deserialization of Untrusted Data). EPSS estimates a 9.25% chance of exploitation in the next 30 days.
Description
Wazuh is a free and open source platform used for threat prevention, detection, and response. Versions 4.0.0 through 4.14.2 have a Remote Code Execution (RCE) vulnerability due to Deserialization of Untrusted Data). All Wazuh deployments using cluster mode (master/worker architecture) and any organization with a compromised worker node (e.g., through initial access, insider threat, or supply chain attack) are impacted. An attacker who gains access to a worker node (through any means) can achieve full RCE on the master node with root privileges. Version 4.14.3 fixes the issue.
Metrics
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Wazuh | Wazuh | >= 4.0.0, < 4.14.3 |
References
- https://github.com/wazuh/wazuh/security/advisories/GHSA-3gm7-962f-fxw5Exploit, Vendor Advisory
- https://github.com/wazuh/wazuh/security/advisories/GHSA-3gm7-962f-fxw5Exploit, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-25769?
How severe is CVE-2026-25769?
How do I fix CVE-2026-25769?
Are you affected by CVE-2026-25769?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST