Wazuh CVE-2026-25769

Wazuh versions 4.0.0–4.14.2 with cluster mode (master/worker architecture) enabled. Attacker requires compromised worker node access (gained through initial access, insider threat, or supply chain attack). No victim interaction needed. Enables RCE on master node with root privileges.

This vulnerability presents an extremely high real-world risk despite requiring high privileges (compromised worker node) as indicated by the CVSS vector (AV:N/AC:L/PR:H). The 9.1 CVSS score accurately reflects the severity given the scope change (S:C) and full CIA impact. While EPSS data is not available and it's not listed in CISA KEV, the public availability of proof-of-concept materials significantly increases exploitation likelihood. The attack complexity is low once initial worker access is obtained, making this a priority patch for any organization running Wazuh clusters, as lateral movement from worker to master with root privileges represents a catastrophic security failure.

An attacker first gains access to a Wazuh worker node through phishing, supply chain compromise, or exploiting another vulnerability, then sends specially crafted serialized objects to the master node through the cluster communication channel. The master node deserializes these malicious objects without validation, executing arbitrary code with root privileges and giving the attacker complete control over the entire Wazuh infrastructure. Proof-of-concept code is publicly available, making this attack scenario readily implementable by motivated attackers.