CVE-2026-25770

Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 3.9.0 and prior to version 4.14.3, a privilege escalation vulnerability exists in the Wazuh Manager's cluster synchronization protocol. The `wazuh-clusterd` service allows authenticated nodes to write arbitrary files to the manager’s file system with the permissions of the `wazuh` system user. Due to insecure default permissions, the `wazuh` user has write access to the manager's main configuration file (`/var/ossec/etc/ossec.conf`). By leveraging the cluster protocol to overwrite `ossec.conf`, an attacker can inject a malicious `<localfile>` command block. The `wazuh-logcollector` service, which runs as root, parses this configuration and executes the injected command. This chain allows an attacker with cluster credentials to gain full Root Remote Code Execution, violating the principle of least privilege and bypassing the intended security model. Version 4.14.3 fixes the issue.

• CWE-22
• CWE-269
• CWE-732

• https://github.com/wazuh/wazuh/security/advisories/GHSA-r4f7-v3p6-79jmExploit, Mitigation, Vendor Advisory

Published

Mar 17, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-25765Faraday is an HTTP client library abstraction layer that pro…5.8
• CVE-2026-25766Echo is a Go web framework. In versions 5.0.0 through 5.0.2 …5.3
• CVE-2026-25767LavinMQ is a high-performance message queue & streaming serv…8.1
• CVE-2026-25768LavinMQ is a high-performance message queue & streaming serv…6.5
• CVE-2026-25769Wazuh is a free and open source platform used for threat pre…9.1
• CVE-2026-2577The WhatsApp bridge component in Nanobot binds the WebSocket…10
• CVE-2026-25771Wazuh is a free and open source platform used for threat pre…7.5
• CVE-2026-25772Wazuh is a free and open source platform used for threat pre…7.2
• CVE-2026-25773** UNSUPPORTED WHEN ASSIGNED ** Focalboard version 8.0 fails…6.5
• CVE-2026-25774Charging station authentication identifiers are publicly acc…5.3
• CVE-2026-25775A vulnerability in SenseLive X3050’s remote management servi…9.8
• CVE-2026-25776Movable Type provided by Six Apart Ltd. contains a code inje…9.8