EUVD-2026-12597Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as cluster node
-
DeliveryExploit cluster sync protocol
-
ExploitWrite arbitrary file to manager filesystem
-
ExecutionOverwrite ossec.conf configuration
-
ImpactExecute commands with wazuh user privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires Wazuh Manager versions 3.9.0–4.14.2 with cluster mode enabled and wazuh-clusterd service running. Attacker must be an authenticated cluster node with high privileges (PR:H) in the cluster synchronization protocol. No user interaction needed. |
| Impact | The CVSS score of 9.1 (Critical) reflects high impact potential with network attack vector, low complexity, and high privileges required. The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) indicates that while the vulnerability requires high privileges (cluster authentication), it can be exploited remotely with no user interaction and affects confidentiality, integrity, and availability across security boundaries. However, the high privilege requirement significantly limits the attack surface to scenarios where cluster credentials are compromised. Without EPSS data, KEV listing, or known POCs, this appears to be a high-impact but lower-likelihood vulnerability primarily concerning organizations with compromised cluster authentication or malicious insiders. |
| Exploit ScenarioDerived | An attacker who has compromised cluster authentication credentials or gained access to a cluster node can exploit the path traversal vulnerability in wazuh-clusterd to overwrite the manager's configuration file with malicious localfile directives. When the wazuh-logcollector service (running as root) reloads the configuration, it executes the injected commands with full system privileges, achieving remote code execution. Given the network-based attack vector and low complexity once authenticated, this could be automated for rapid exploitation across multiple Wazuh deployments sharing the same cluster credentials. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 17, 2026
Privilege escalation in Wazuh Manager versions 3.9.0 through 4.14.2 allows authenticated cluster nodes to achieve unauthenticated root code execution by exploiting insecure file permissions in the cluster synchronization protocol. An attacker with cluster node access can overwrite the manager's configuration file to inject malicious commands that are subsequently executed with root privileges by the logcollector service. This vulnerability affects multi-node Wazuh deployments and has no available patch.
Earlier versions of this analysis (1)
A privilege escalation vulnerability in Wazuh Manager's cluster synchronization protocol allows authenticated nodes to write arbitrary files and execute commands as root. Wazuh versions 3.9.0 through 4.14.2 are affected, where attackers with cluster credentials can leverage insecure file permissions to inject malicious configuration that gets executed by the root-level wazuh-logcollector service. No active exploitation has been reported in KEV, and no public POC is currently available based on the provided intelligence.
RemediationAI
Upgrade Wazuh Manager to version 4.14.3 or later, which contains the official fix for this vulnerability as documented in the GitHub advisory at https://github.com/wazuh/wazuh/security/advisories/GHSA-r4f7-v3p6-79jm. As an immediate mitigation before patching, restrict cluster authentication credentials to only trusted systems, implement network segmentation to limit cluster communication to authorized nodes only, and monitor file system changes to /var/ossec/etc/ossec.conf for unauthorized modifications. Organizations should also review and audit existing cluster node authentication to ensure no unauthorized access exists.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Wazuh is an open-source security monitoring platform (identified by CPE cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*) that uses a clustered architecture where nodes synchronize data through the wazuh-clusterd service. The vulnerability is classified as CWE-22 (Path Traversal), where the cluster protocol fails to properly validate file paths, allowing authenticated nodes to write to arbitrary locations including the main configuration file at /var/ossec/etc/ossec.conf. The insecure default permissions grant the wazuh user write access to this critical configuration file, which is then parsed by the wazuh-logcollector service running with root privileges, creating a privilege escalation chain.
Know when Wazuh gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 3.9.0 and prior to version 4.14.3, a privilege escalation vulnerability exists in the Wazuh Manager's cluster synchronization protocol. The wazuh-clusterd service allows authenticated nodes to write arbitrary files to the manager’s file system with the permissions of the wazuh system user. Due to insecure default permissions, the wazuh user has write access to the manager's main configuration file (/var/ossec/etc/ossec.conf). By leveraging the cluster protocol to overwrite ossec.conf, an attacker can inject a malicious <localfile> command block. The wazuh-logcollector service, which runs as root, parses this configuration and executes the injected command. This chain allows an attacker with cluster credentials to gain full Root Remote Code Execution, violating the principle of least privilege and bypassing the intended security model. Version 4.14.3 fixes the issue.
Executive ViewAI
CVE-2026-25770 is a critical privilege escalation vulnerability in Wazuh Manager (versions 3.9.0-4.14.2) that allows authenticated cluster nodes to execute arbitrary commands as root through insecure file permissions in cluster synchronization. Organizations running multi-node Wazuh deployments are at immediate risk of complete security infrastructure compromise, as attackers can hijack the manager's configuration to execute malicious code with the highest privileges.
Patch available per vendor advisory. Interim mitigations: restrict cluster node connectivity to whitelisted IP addresses; disable cluster mode if not operationally required; implement strict file system permissions (read-only) on Wazuh manager configuration files where possible; deploy file integrity monitoring (FIM) on /var/ossec/etc/ to detect unauthorized configuration changes.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Related Vulnerabilities in Wazuh Platform Remote Code Execution
View all 3Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
In the wazuh-slack active response script in Wazuh 4.2.x before 4.2.5, untrusted user agents are passed to a curl comman
Path-traversal-driven root code execution affects the Wazuh security platform's cluster synchronization layer in version
Arbitrary file read in Wazuh cluster deployments (4.0.0 through 4.14.5, and 5.0.0-beta1/beta2) lets a peer node that alr
Arbitrary file write leading to root remote code execution affects Wazuh worker nodes in clustered deployments running v
Wazuh Agent before 4.13.0 on Windows can be made by an authenticated, high-privileged configuration writer to open attac
Remote code execution on the Wazuh cluster master node is achievable by any attacker who controls a cluster worker node,
Path traversal in Wazuh's ip-customblock active response script allows low-privileged remote attackers to create or dele
The agent in OSSEC through 3.1.0 on Windows allows local users to gain NT AUTHORITY\SYSTEM access via Directory Traversa
Cluster key disclosure in Wazuh Manager versions 4.0.0 through 4.14.4 enables a two-stage privilege escalation: a low-pr
Unauthenticated remote denial of service in the Wazuh cluster daemon (wazuh-clusterd) allows a network peer to exhaust p
Exploit-DB