Wazuh CVE-2026-54085

Exploitation requires the attacker to control or inject content into a log source actively monitored by Wazuh-for example, a syslog daemon, a file Wazuh's agent tails, or a forwarded event stream. At least one active response rule must be configured in ossec.conf and must fire in response to the crafted event; active response is an opt-in feature requiring explicit rule-to-script binding, but is commonly enabled in production deployments. The CVSS PR:L vector indicates low-privilege authenticated access is required, consistent with the need to generate log events from a recognized or reachable source. For the srcip injection path, the triggering rule must invoke one of the five unpatched scripts (route-null, netsh, pf, npf, ipfw). For the dstuser path, the rule must invoke disable-account.c. The Windows-specific unquoted argument path requires the triggered script to be a Windows binary invoked through wpopenv(). Exploitation is constrained to deployments with active response enabled, a reachable log injection point, and applicable rule configurations-these deployment conditions materially limit the realistic at-risk population beyond what the raw CVSS score implies.

The CVSS 7.1 score (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L) accurately reflects network-reachable exploitation requiring only low-privilege access to a Wazuh-monitored log source, such as the ability to write syslog messages. The high integrity impact corresponds to the ability to inject arguments into root-executed firewall commands, and the low availability impact reflects the ability to lock arbitrary system accounts via disable-account.c. No EPSS score was present in the provided intelligence data, limiting probabilistic exploitation forecasting. This CVE is not in CISA KEV and no public exploit code has been identified, suggesting targeted risk rather than opportunistic mass exploitation. Real-world risk is elevated for any Wazuh deployment with active response rules enabled-a common production configuration-where an attacker can reach a monitored syslog endpoint. The dependency on active response being configured and a rule firing represents a meaningful environmental constraint not captured by the raw CVSS score.

An attacker with access to a syslog source monitored by Wazuh sends a crafted log entry containing a srcip value of '1.2.3.4 -f /etc/some_config' or a dstuser value with embedded command characters. When a configured active response rule matches the event, Wazuh passes the unvalidated value to a root-executing command such as ipfw or passwd, injecting the extra tokens as additional arguments. On Windows, a srcip containing a space exploits wpopenv()'s unquoted CreateProcess concatenation to append attacker-controlled arguments to the spawned process command line, achieving the same result via a platform-specific code path.