46
CVEs
8
Critical
19
High
0
KEV
10
PoC
9
Unpatched C/H
63.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
8
HIGH
19
MEDIUM
19
LOW
0
Monthly CVE Trend
Affected Products (9)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-48024 | Path-traversal-driven root code execution affects the Wazuh security platform's cluster synchronization layer in versions 4.0.0 through 4.14.5 and the 5.0.0-beta line up to 5.0.0-beta3. A malicious or compromised cluster peer that possesses the shared Fernet key can smuggle directory-traversal sequences through merge_type/name values or a merged-file header, causing the master node to write attacker-controlled files (e.g. /var/ossec/etc/ossec.conf) outside the intended cluster item directory; overwriting ossec.conf lets the attacker define root-executed commands that fire when Wazuh services reload. No public exploit has been identified at time of analysis, and the issue is not in CISA KEV; the vendor fix landed in 4.14.6 and 5.0.0-beta3. | CRITICAL | 9.1 | 0.8% | 66 |
PoC
|
| CVE-2026-48162 | Arbitrary file read in Wazuh cluster deployments (4.0.0 through 4.14.5, and 5.0.0-beta1/beta2) lets a peer node that already holds the shared cluster Fernet key coerce the master into returning any file it can read over the encrypted cluster channel. By retrieving /var/ossec/api/configuration/security/private_key.pem, that peer can forge administrator REST API tokens offline and exercise full administrative privileges without ever creating an account. No public exploit identified at time of analysis; the underlying fix is confirmed in the vendor advisory and shipped in 4.14.6 and 5.0.0-beta3. | CRITICAL | 9.1 | 0.6% | 66 |
PoC
|
| CVE-2026-61800 | Arbitrary file write leading to root remote code execution affects Wazuh worker nodes in clustered deployments running versions 4.4.0 through 4.14.6. A peer that possesses the shared cluster key can abuse the file-synchronization routine to drop, overwrite, or delete files at attacker-chosen paths under /var/ossec - including scripts executed as root - because the worker's non-merged sync branch never verifies that a synced file matches the directory declared by its cluster_item_key. This is an incomplete fix for CVE-2026-30893, and no public exploit has been identified at time of analysis; it is fixed in 4.14.7. | CRITICAL | 9.1 | 0.6% | 66 |
PoC
No patch
|
| CVE-2026-44901 | Remote code execution on the Wazuh cluster master node is achievable by any attacker who controls a cluster worker node, exploiting unsafe Python builtin resolution in the distributed API merge path. Affected versions span 4.0.0 through 4.14.5 and 5.0.0-beta1; the vulnerable code in framework/wazuh/core/results.py called getattr(builtins, type_) with attacker-supplied strings from worker JSON responses, enabling exec or eval injection. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the attack primitive is mechanically trivial once a worker node is controlled, with the payload executing as root on the master. | HIGH | 8.4 | 0.7% | 63 |
PoC
|
| CVE-2026-54083 | Path traversal in Wazuh's ip-customblock active response script allows low-privileged remote attackers to create or delete arbitrary files as root by injecting directory traversal sequences into the srcip field of alert-triggering log events. Versions prior to 4.14.7 are affected when ip-customblock is configured as an active response - the block action creates an empty file at an attacker-controlled path, while the unblock action deletes it, both executing as root and enabling destruction of credentials, configuration, or other critical files. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog, though the missing validation is trivially observable by comparing ip-customblock.c against its sibling scripts. | HIGH | 8.1 | 0.3% | 61 |
PoC
No patch
|
| CVE-2026-44252 | Cluster key disclosure in Wazuh Manager versions 4.0.0 through 4.14.4 enables a two-stage privilege escalation: a low-privilege API user with manager:read permission can retrieve the plaintext Fernet cluster key via the raw configuration endpoint, then use it to impersonate a cluster worker node and inject attacker-controlled RBAC permissions that grant full administrative access. The master node's unconditional trust in worker-supplied authorization context (CWE-863 - Incorrect Authorization) allows an attacker to create admin users, access stored credentials and API tokens, modify platform configuration, and execute arbitrary commands across all Wazuh-managed agents. No public exploit has been identified at time of analysis; the vendor-released fix is confirmed in version 4.14.5. | HIGH | 7.7 | 0.3% | 59 |
PoC
|
| CVE-2026-46343 | Arbitrary file deletion on a Wazuh manager via the cluster synchronization protocol allows a cluster-authenticated attacker to destroy critical files including ossec.conf, jwt_secret.json, and TLS certificates, effectively disabling the manager or invalidating all API authentication tokens. The flaw spans Wazuh 4.0.0 through 4.14.5 and the 5.0.0-beta2 pre-release, rooted in missing path canonicalization inside the cluster file-receive cleanup handler. No public exploit or active exploitation has been identified at time of analysis; however, CVSS 4.0 rates the vulnerable-system impact as High across confidentiality, integrity, and availability, making this a high-priority patch for any clustered Wazuh deployment. | HIGH | 7.5 | 0.3% | 58 |
PoC
|
| CVE-2026-54085 | Argument injection in Wazuh active response scripts (versions 4.2.0-4.14.6) allows a low-privileged network attacker who controls a monitored log source to inject arbitrary arguments into firewall and account-management commands executing as root. Five scripts handling the srcip alert field (route-null.c, netsh.c, pf.c, npf.c, ipfw.c) omit IP format validation, and disable-account.c passes the dstuser field to passwd/chuser with only a root-name check, enabling injection into pfctl, npfctl, ipfw, route, netsh, and passwd. On Windows, unquoted CreateProcess concatenation in wpopenv() amplifies the impact by allowing space-delimited srcip values to append additional process arguments. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV. | HIGH | 7.1 | 0.2% | 56 |
PoC
No patch
|
| CVE-2026-61783 | Cluster secret exposure in Wazuh 4.14.0-4.14.6 stems from a logic inversion in the RBAC masking gate that counterintuitively makes hardened accounts more exposed than default ones. Any authenticated low-privilege user whose role includes an explicit DENY on config-update actions can issue a single GET request to the manager configuration API with `raw=true` and receive the full `ossec.conf` XML with `cluster.key` in cleartext - because the broken gate treats the mere presence of a deny-rule entry as proof of update permission, disabling masking entirely. No public exploit has been identified at time of analysis, but the fix is available in 4.14.7 and the root cause is confirmed by vendor advisory and merged commit. | HIGH | 7.0 | 0.2% | 55 |
PoC
No patch
|
| CVE-2026-56699 | NDJSON injection in Wazuh Manager before 5.0.0-beta3 lets any enrolled agent smuggle arbitrary OpenSearch bulk operations because the DataValue.index field is not escaped when the manager builds inventory-sync bulk requests. Because those requests execute under the manager's OpenSearch admin credentials, a single low-trust agent can delete documents, tamper with alerts, and manipulate SIEM state across all other agents. Rated CVSS 10.0 by the reporter (VulnCheck); no public exploit identified at time of analysis and it is not listed in CISA KEV. | CRITICAL | 10.0 | 0.4% | 50 |
|
| CVE-2026-49441 | Path-traversal-driven remote code execution in Wazuh 4.3.0 through 4.14.5 (and 5.0.0-beta1/beta2) lets a cluster peer that holds the shared Fernet key overwrite security-sensitive files on the master node. Because the non-merged branch of process_files_from_worker() in master.py trusts the peer-supplied file_path from files_metadata.json without confining it under the directory implied by cluster_item_key, an attacker can replace /var/ossec/etc/ossec.conf to configure root-executed commands and gain code execution on the next service reload. No public exploit identified at time of analysis, but a vendor fix and the fixing commit are public, making the root cause easy to study. | CRITICAL | 9.1 | 0.7% | 46 |
|
| CVE-2026-28220 | Authenticated remote code execution in Wazuh's Cluster Distributed API (DAPI) lets any peer holding the shared cluster key coerce the master node into deserializing an attacker-controlled callable (CWE-502) and running it under a forged RBAC context, yielding full manager compromise. Rated CVSS 9.1 and affecting all cluster deployments from 4.0.0 up to the 4.14.5 fix, it combines an overly broad deserialization allowlist with client-controlled authorization to bypass permission checks entirely. SSVC records a proof-of-concept, so publicly available exploit code exists, though EPSS remains low at 0.19% (9th percentile), consistent with a signal that requires possession of the cluster key rather than opportunistic mass exploitation. | CRITICAL | 9.1 | 0.2% | 46 |
|
| CVE-2026-30893 | Wazuh Manager (4.4.0 through 4.14.3) contains a path traversal vulnerability in the cluster synchronization routine that allows an authenticated cluster peer to write arbitrary files outside the intended extraction directory on other cluster nodes. Writing to sensitive locations such as cron directories or Python module paths leads to remote code execution. CVSS 9.0 Critical (network-accessible, high privilege required, scope changed). Patch available in v4.14.4; no active exploitation identified. | CRITICAL | 9.0 | 0.1% | 45 |
PoC
|
| CVE-2025-15617 | GitHub Actions workflow artifacts in Wazuh version 4.12.0 expose GITHUB_TOKEN credentials that unauthenticated network attackers can extract and use within a limited time window to push malicious commits or alter release tags in the project repository. The vulnerability carries a CVSS 4.0 score of 8.3 with high integrity impact and low availability impact. No public exploit identified at time of analysis, though the vulnerability is classified under authentication bypass tags by VulnCheck. | HIGH | 8.3 | 0.0% | 42 |
No patch
|
| CVE-2026-41424 | Privilege escalation in Wazuh 4.9.0-4.10.3 and 4.11.0-4.14.5 allows any authenticated user holding the users_admin role to overwrite the password of protected built-in administrator accounts - including the wazuh superuser - via a logic flaw in the PUT /security/users/{user_id} REST API endpoint. The API controller passes request.get("user"), which resolves to None because that key is absent from the request object, instead of extracting the authenticated principal from the JWT token; remove_nones_to_dict() then silently strips the None before it reaches the reserved-account authorization guard in the framework layer, causing the protection check to fail open. The issue is confirmed fixed in v4.10.4 and v4.14.6; no public exploit code or CISA KEV listing has been identified at time of analysis. | HIGH | 8.2 | 0.3% | 41 |
|