67
CVEs
13
Critical
27
High
1
KEV
21
PoC
12
Unpatched C/H
65.7%
Patch Rate
1.9%
Avg EPSS
Severity Breakdown
CRITICAL
13
HIGH
27
MEDIUM
26
LOW
1
Monthly CVE Trend
Affected Products (9)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2025-24016 | Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI that allows remote code execution on Wazuh management servers. | CRITICAL | 9.9 | 93.9% | 228 |
KEV
PoC
|
| CVE-2021-44079 | In the wazuh-slack active response script in Wazuh 4.2.x before 4.2.5, untrusted user agents are passed to a curl command line, potentially resulting in remote code execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available. | CRITICAL | 9.8 | 3.3% | 69 |
PoC
|
| CVE-2026-48024 | Path-traversal-driven root code execution affects the Wazuh security platform's cluster synchronization layer in versions 4.0.0 through 4.14.5 and the 5.0.0-beta line up to 5.0.0-beta3. A malicious or compromised cluster peer that possesses the shared Fernet key can smuggle directory-traversal sequences through merge_type/name values or a merged-file header, causing the master node to write attacker-controlled files (e.g. /var/ossec/etc/ossec.conf) outside the intended cluster item directory; overwriting ossec.conf lets the attacker define root-executed commands that fire when Wazuh services reload. No public exploit has been identified at time of analysis, and the issue is not in CISA KEV; the vendor fix landed in 4.14.6 and 5.0.0-beta3. | CRITICAL | 9.1 | 0.8% | 66 |
PoC
|
| CVE-2026-48162 | Arbitrary file read in Wazuh cluster deployments (4.0.0 through 4.14.5, and 5.0.0-beta1/beta2) lets a peer node that already holds the shared cluster Fernet key coerce the master into returning any file it can read over the encrypted cluster channel. By retrieving /var/ossec/api/configuration/security/private_key.pem, that peer can forge administrator REST API tokens offline and exercise full administrative privileges without ever creating an account. No public exploit identified at time of analysis; the underlying fix is confirmed in the vendor advisory and shipped in 4.14.6 and 5.0.0-beta3. | CRITICAL | 9.1 | 0.6% | 66 |
PoC
|
| CVE-2026-61800 | Arbitrary file write leading to root remote code execution affects Wazuh worker nodes in clustered deployments running versions 4.4.0 through 4.14.6. A peer that possesses the shared cluster key can abuse the file-synchronization routine to drop, overwrite, or delete files at attacker-chosen paths under /var/ossec - including scripts executed as root - because the worker's non-merged sync branch never verifies that a synced file matches the directory declared by its cluster_item_key. This is an incomplete fix for CVE-2026-30893, and no public exploit has been identified at time of analysis; it is fixed in 4.14.7. | CRITICAL | 9.1 | 0.6% | 66 |
PoC
No patch
|
| CVE-2026-25769 | A critical deserialization vulnerability in Wazuh's cluster mode allows attackers with access to any worker node to achieve remote code execution with root privileges on the master node. The vulnerability affects Wazuh versions 4.0.0 through 4.14.2 and poses severe risk to organizations using Wazuh in distributed deployments, as compromise of any single worker node can lead to full cluster takeover. While no active exploitation has been reported (not in KEV), proof-of-concept materials are publicly available via the Google Drive link in the advisory. | CRITICAL | 9.1 | 0.4% | 66 |
PoC
|
| CVE-2026-44901 | Remote code execution on the Wazuh cluster master node is achievable by any attacker who controls a cluster worker node, exploiting unsafe Python builtin resolution in the distributed API merge path. Affected versions span 4.0.0 through 4.14.5 and 5.0.0-beta1; the vulnerable code in framework/wazuh/core/results.py called getattr(builtins, type_) with attacker-supplied strings from worker JSON responses, enabling exec or eval injection. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the attack primitive is mechanically trivial once a worker node is controlled, with the payload executing as root on the master. | HIGH | 8.4 | 0.7% | 63 |
PoC
|
| CVE-2026-54083 | Path traversal in Wazuh's ip-customblock active response script allows low-privileged remote attackers to create or delete arbitrary files as root by injecting directory traversal sequences into the srcip field of alert-triggering log events. Versions prior to 4.14.7 are affected when ip-customblock is configured as an active response - the block action creates an empty file at an attacker-controlled path, while the unblock action deletes it, both executing as root and enabling destruction of credentials, configuration, or other critical files. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog, though the missing validation is trivially observable by comparing ip-customblock.c against its sibling scripts. | HIGH | 8.1 | 0.3% | 61 |
PoC
No patch
|
| CVE-2018-19666 | The agent in OSSEC through 3.1.0 on Windows allows local users to gain NT AUTHORITY\SYSTEM access via Directory Traversal by leveraging full access to the associated OSSEC server. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 7.8 | 0.8% | 59 |
PoC
No patch
|
| CVE-2026-44252 | Cluster key disclosure in Wazuh Manager versions 4.0.0 through 4.14.4 enables a two-stage privilege escalation: a low-privilege API user with manager:read permission can retrieve the plaintext Fernet cluster key via the raw configuration endpoint, then use it to impersonate a cluster worker node and inject attacker-controlled RBAC permissions that grant full administrative access. The master node's unconditional trust in worker-supplied authorization context (CWE-863 - Incorrect Authorization) allows an attacker to create admin users, access stored credentials and API tokens, modify platform configuration, and execute arbitrary commands across all Wazuh-managed agents. No public exploit has been identified at time of analysis; the vendor-released fix is confirmed in version 4.14.5. | HIGH | 7.7 | 0.3% | 59 |
PoC
|
| CVE-2026-46343 | Arbitrary file deletion on a Wazuh manager via the cluster synchronization protocol allows a cluster-authenticated attacker to destroy critical files including ossec.conf, jwt_secret.json, and TLS certificates, effectively disabling the manager or invalidating all API authentication tokens. The flaw spans Wazuh 4.0.0 through 4.14.5 and the 5.0.0-beta2 pre-release, rooted in missing path canonicalization inside the cluster file-receive cleanup handler. No public exploit or active exploitation has been identified at time of analysis; however, CVSS 4.0 rates the vulnerable-system impact as High across confidentiality, integrity, and availability, making this a high-priority patch for any clustered Wazuh deployment. | HIGH | 7.5 | 0.3% | 58 |
PoC
|
| CVE-2024-1243 | CVE-2024-1243 is an improper input validation vulnerability in Wazuh agent for Windows (versions prior to 4.8.0) that allows attackers with control over the Wazuh server or possession of agent keys to redirect agents to malicious UNC paths, resulting in NetNTLMv2 hash leakage. The leaked hash can be relayed for remote code execution or abused for privilege escalation to SYSTEM level via AD CS certificate forging. This vulnerability represents a critical supply-chain/credential-leakage risk for Windows environments using Wazuh, though exploitation requires elevated privileges (high PR requirement) and knowledge of agent keys or server compromise. | HIGH | 7.2 | 0.5% | 57 |
PoC
|
| CVE-2026-54085 | Argument injection in Wazuh active response scripts (versions 4.2.0-4.14.6) allows a low-privileged network attacker who controls a monitored log source to inject arbitrary arguments into firewall and account-management commands executing as root. Five scripts handling the srcip alert field (route-null.c, netsh.c, pf.c, npf.c, ipfw.c) omit IP format validation, and disable-account.c passes the dstuser field to passwd/chuser with only a root-name check, enabling injection into pfctl, npfctl, ipfw, route, netsh, and passwd. On Windows, unquoted CreateProcess concatenation in wpopenv() amplifies the impact by allowing space-delimited srcip values to append additional process arguments. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV. | HIGH | 7.1 | 0.2% | 56 |
PoC
No patch
|
| CVE-2026-61783 | Cluster secret exposure in Wazuh 4.14.0-4.14.6 stems from a logic inversion in the RBAC masking gate that counterintuitively makes hardened accounts more exposed than default ones. Any authenticated low-privilege user whose role includes an explicit DENY on config-update actions can issue a single GET request to the manager configuration API with `raw=true` and receive the full `ossec.conf` XML with `cluster.key` in cleartext - because the broken gate treats the mere presence of a deny-rule entry as proof of update permission, disabling masking entirely. No public exploit has been identified at time of analysis, but the fix is available in 4.14.7 and the root cause is confirmed by vendor advisory and merged commit. | HIGH | 7.0 | 0.2% | 55 |
PoC
No patch
|
| CVE-2021-41821 | Wazuh Manager in Wazuh through 4.1.5 is affected by a remote Integer Underflow vulnerability that might lead to denial of service. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 6.5 | 1.1% | 52 |
PoC
No patch
|