Wazuh

CVE	Summary	Severity	CVSS	EPSS	Priority	Signals
CVE-2026-48024	Path-traversal-driven root code execution affects the Wazuh security platform's cluster synchronization layer in versions 4.0.0 through 4.14.5 and the 5.0.0-beta line up to 5.0.0-beta3. A malicious or compromised cluster peer that possesses the shared Fernet key can smuggle directory-traversal sequences through merge_type/name values or a merged-file header, causing the master node to write attacker-controlled files (e.g. /var/ossec/etc/ossec.conf) outside the intended cluster item directory; overwriting ossec.conf lets the attacker define root-executed commands that fire when Wazuh services reload. No public exploit has been identified at time of analysis, and the issue is not in CISA KEV; the vendor fix landed in 4.14.6 and 5.0.0-beta3.	CRITICAL	9.1	0.8%	66	PoC
CVE-2026-48162	Arbitrary file read in Wazuh cluster deployments (4.0.0 through 4.14.5, and 5.0.0-beta1/beta2) lets a peer node that already holds the shared cluster Fernet key coerce the master into returning any file it can read over the encrypted cluster channel. By retrieving /var/ossec/api/configuration/security/private_key.pem, that peer can forge administrator REST API tokens offline and exercise full administrative privileges without ever creating an account. No public exploit identified at time of analysis; the underlying fix is confirmed in the vendor advisory and shipped in 4.14.6 and 5.0.0-beta3.	CRITICAL	9.1	0.6%	66	PoC
CVE-2026-61800	Arbitrary file write leading to root remote code execution affects Wazuh worker nodes in clustered deployments running versions 4.4.0 through 4.14.6. A peer that possesses the shared cluster key can abuse the file-synchronization routine to drop, overwrite, or delete files at attacker-chosen paths under /var/ossec - including scripts executed as root - because the worker's non-merged sync branch never verifies that a synced file matches the directory declared by its cluster_item_key. This is an incomplete fix for CVE-2026-30893, and no public exploit has been identified at time of analysis; it is fixed in 4.14.7.	CRITICAL	9.1	0.6%	66	PoC No patch
CVE-2026-44901	Remote code execution on the Wazuh cluster master node is achievable by any attacker who controls a cluster worker node, exploiting unsafe Python builtin resolution in the distributed API merge path. Affected versions span 4.0.0 through 4.14.5 and 5.0.0-beta1; the vulnerable code in framework/wazuh/core/results.py called getattr(builtins, type_) with attacker-supplied strings from worker JSON responses, enabling exec or eval injection. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the attack primitive is mechanically trivial once a worker node is controlled, with the payload executing as root on the master.	HIGH	8.4	0.7%	63	PoC
CVE-2026-54083	Path traversal in Wazuh's ip-customblock active response script allows low-privileged remote attackers to create or delete arbitrary files as root by injecting directory traversal sequences into the srcip field of alert-triggering log events. Versions prior to 4.14.7 are affected when ip-customblock is configured as an active response - the block action creates an empty file at an attacker-controlled path, while the unblock action deletes it, both executing as root and enabling destruction of credentials, configuration, or other critical files. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog, though the missing validation is trivially observable by comparing ip-customblock.c against its sibling scripts.	HIGH	8.1	0.3%	61	PoC No patch
CVE-2026-44252	Cluster key disclosure in Wazuh Manager versions 4.0.0 through 4.14.4 enables a two-stage privilege escalation: a low-privilege API user with manager:read permission can retrieve the plaintext Fernet cluster key via the raw configuration endpoint, then use it to impersonate a cluster worker node and inject attacker-controlled RBAC permissions that grant full administrative access. The master node's unconditional trust in worker-supplied authorization context (CWE-863 - Incorrect Authorization) allows an attacker to create admin users, access stored credentials and API tokens, modify platform configuration, and execute arbitrary commands across all Wazuh-managed agents. No public exploit has been identified at time of analysis; the vendor-released fix is confirmed in version 4.14.5.	HIGH	7.7	0.3%	59	PoC
CVE-2026-46343	Arbitrary file deletion on a Wazuh manager via the cluster synchronization protocol allows a cluster-authenticated attacker to destroy critical files including ossec.conf, jwt_secret.json, and TLS certificates, effectively disabling the manager or invalidating all API authentication tokens. The flaw spans Wazuh 4.0.0 through 4.14.5 and the 5.0.0-beta2 pre-release, rooted in missing path canonicalization inside the cluster file-receive cleanup handler. No public exploit or active exploitation has been identified at time of analysis; however, CVSS 4.0 rates the vulnerable-system impact as High across confidentiality, integrity, and availability, making this a high-priority patch for any clustered Wazuh deployment.	HIGH	7.5	0.3%	58	PoC
CVE-2026-54085	Argument injection in Wazuh active response scripts (versions 4.2.0-4.14.6) allows a low-privileged network attacker who controls a monitored log source to inject arbitrary arguments into firewall and account-management commands executing as root. Five scripts handling the srcip alert field (route-null.c, netsh.c, pf.c, npf.c, ipfw.c) omit IP format validation, and disable-account.c passes the dstuser field to passwd/chuser with only a root-name check, enabling injection into pfctl, npfctl, ipfw, route, netsh, and passwd. On Windows, unquoted CreateProcess concatenation in wpopenv() amplifies the impact by allowing space-delimited srcip values to append additional process arguments. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV.	HIGH	7.1	0.2%	56	PoC No patch
CVE-2026-61783	Cluster secret exposure in Wazuh 4.14.0-4.14.6 stems from a logic inversion in the RBAC masking gate that counterintuitively makes hardened accounts more exposed than default ones. Any authenticated low-privilege user whose role includes an explicit DENY on config-update actions can issue a single GET request to the manager configuration API with `raw=true` and receive the full `ossec.conf` XML with `cluster.key` in cleartext - because the broken gate treats the mere presence of a deny-rule entry as proof of update permission, disabling masking entirely. No public exploit has been identified at time of analysis, but the fix is available in 4.14.7 and the root cause is confirmed by vendor advisory and merged commit.	HIGH	7.0	0.2%	55	PoC No patch
CVE-2026-49441	Path-traversal-driven remote code execution in Wazuh 4.3.0 through 4.14.5 (and 5.0.0-beta1/beta2) lets a cluster peer that holds the shared Fernet key overwrite security-sensitive files on the master node. Because the non-merged branch of process_files_from_worker() in master.py trusts the peer-supplied file_path from files_metadata.json without confining it under the directory implied by cluster_item_key, an attacker can replace /var/ossec/etc/ossec.conf to configure root-executed commands and gain code execution on the next service reload. No public exploit identified at time of analysis, but a vendor fix and the fixing commit are public, making the root cause easy to study.	CRITICAL	9.1	0.7%	46
CVE-2026-41424	Privilege escalation in Wazuh 4.9.0-4.10.3 and 4.11.0-4.14.5 allows any authenticated user holding the users_admin role to overwrite the password of protected built-in administrator accounts - including the wazuh superuser - via a logic flaw in the PUT /security/users/{user_id} REST API endpoint. The API controller passes request.get("user"), which resolves to None because that key is absent from the request object, instead of extracting the authenticated principal from the JWT token; remove_nones_to_dict() then silently strips the None before it reaches the reserved-account authorization guard in the framework layer, causing the protection check to fail open. The issue is confirmed fixed in v4.10.4 and v4.14.6; no public exploit code or CISA KEV listing has been identified at time of analysis.	HIGH	8.2	0.3%	41
CVE-2026-45798	Stack-based buffer overflow in Wazuh's wazuh-authd enrollment daemon (versions 4.5.0 through 4.14.5 and 5.0.0-beta1) allows unauthenticated remote attackers to crash the service by sending a crafted nine-byte version string in the enrollment 'V:' field, triggering unsafe stack memory reads and a null byte write into adjacent stack frames. The vulnerable code path in compare_wazuh_versions() is reachable before authentication over TCP port 1515 when anonymous TLS enrollment is enabled, resulting in a denial of service against the agent enrollment service. No active exploitation has been confirmed (not in CISA KEV) and no public proof-of-concept has been identified at time of analysis; vendor-released patches are available in versions 4.14.6 and 5.0.0-beta2.	HIGH	7.5	0.9%	38
CVE-2026-74039	CPU exhaustion in Wazuh Manager 4.0.0-4.14.6 and 5.0.0-beta2 allows authenticated API users with the allow_run_as permission to fully deny service to all other API consumers by submitting arbitrarily deeply nested JSON to the POST /security/user/authenticate/run_as endpoint. The API framework processes these structures recursively without any depth or size limit, consuming CPU proportionally to nesting depth until the process becomes unresponsive. No public exploit identified at time of analysis, though the attack primitive is trivially constructible from the CVE description alone.	HIGH	7.1	0.3%	36
CVE-2026-74044	Path traversal via unsanitized cluster node names in Wazuh Manager 4.0.0 through 4.14.5 enables authenticated cluster peers to delete arbitrary directory contents on the master node. An attacker holding a valid cluster Fernet key can supply a traversal-shaped node name (e.g., '../../etc') in the cluster hello handshake, then disconnect - causing the master's peer cleanup routine to recursively remove the contents of directories outside the intended cluster queue path, writable by the wazuh user. No public exploit has been identified at time of analysis, and a vendor patch is available in 4.14.6.	HIGH	7.0	0.4%	35
CVE-2026-74038	Path traversal in Wazuh Manager 4.0.0 through 4.14.5 allows unauthenticated remote attackers to destroy the manager's queue directory structure and halt all Wazuh services by registering an agent whose name begins with a dot (e.g., ".."). Two compounding weaknesses drive the impact: OS_IsValidName() failed to reject dot-prefixed agent names, and delete_diff() performs unsafe path concatenation that resolves the traversal sequence to the parent queue directory, wiping its subdirectories. Recovery requires manual intervention, creating a complete and sustained loss of SIEM and XDR visibility. No public exploit or CISA KEV listing has been identified at time of analysis.	HIGH	7.0	0.4%	35

CVE-2026-48024

Path-traversal-driven root code execution affects the Wazuh security platform's cluster synchronization layer in versions 4.0.0 through 4.14.5 and the 5.0.0-beta line up to 5.0.0-beta3. A malicious or compromised cluster peer that possesses the shared Fernet key can smuggle directory-traversal sequences through merge_type/name values or a merged-file header, causing the master node to write attacker-controlled files (e.g. /var/ossec/etc/ossec.conf) outside the intended cluster item directory; overwriting ossec.conf lets the attacker define root-executed commands that fire when Wazuh services reload. No public exploit has been identified at time of analysis, and the issue is not in CISA KEV; the vendor fix landed in 4.14.6 and 5.0.0-beta3.

CRITICAL

9.1

0.8%

66

PoC

CVE-2026-48162

Arbitrary file read in Wazuh cluster deployments (4.0.0 through 4.14.5, and 5.0.0-beta1/beta2) lets a peer node that already holds the shared cluster Fernet key coerce the master into returning any file it can read over the encrypted cluster channel. By retrieving /var/ossec/api/configuration/security/private_key.pem, that peer can forge administrator REST API tokens offline and exercise full administrative privileges without ever creating an account. No public exploit identified at time of analysis; the underlying fix is confirmed in the vendor advisory and shipped in 4.14.6 and 5.0.0-beta3.

CRITICAL

9.1

0.6%

66

PoC

CVE-2026-61800

Arbitrary file write leading to root remote code execution affects Wazuh worker nodes in clustered deployments running versions 4.4.0 through 4.14.6. A peer that possesses the shared cluster key can abuse the file-synchronization routine to drop, overwrite, or delete files at attacker-chosen paths under /var/ossec - including scripts executed as root - because the worker's non-merged sync branch never verifies that a synced file matches the directory declared by its cluster_item_key. This is an incomplete fix for CVE-2026-30893, and no public exploit has been identified at time of analysis; it is fixed in 4.14.7.

CRITICAL

9.1

0.6%

66

PoC No patch

CVE-2026-44901

Remote code execution on the Wazuh cluster master node is achievable by any attacker who controls a cluster worker node, exploiting unsafe Python builtin resolution in the distributed API merge path. Affected versions span 4.0.0 through 4.14.5 and 5.0.0-beta1; the vulnerable code in framework/wazuh/core/results.py called getattr(builtins, type_) with attacker-supplied strings from worker JSON responses, enabling exec or eval injection. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the attack primitive is mechanically trivial once a worker node is controlled, with the payload executing as root on the master.

HIGH

8.4

0.7%

63

PoC

CVE-2026-54083

Path traversal in Wazuh's ip-customblock active response script allows low-privileged remote attackers to create or delete arbitrary files as root by injecting directory traversal sequences into the srcip field of alert-triggering log events. Versions prior to 4.14.7 are affected when ip-customblock is configured as an active response - the block action creates an empty file at an attacker-controlled path, while the unblock action deletes it, both executing as root and enabling destruction of credentials, configuration, or other critical files. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog, though the missing validation is trivially observable by comparing ip-customblock.c against its sibling scripts.

HIGH

8.1

0.3%

61

PoC No patch

CVE-2026-44252

Cluster key disclosure in Wazuh Manager versions 4.0.0 through 4.14.4 enables a two-stage privilege escalation: a low-privilege API user with manager:read permission can retrieve the plaintext Fernet cluster key via the raw configuration endpoint, then use it to impersonate a cluster worker node and inject attacker-controlled RBAC permissions that grant full administrative access. The master node's unconditional trust in worker-supplied authorization context (CWE-863 - Incorrect Authorization) allows an attacker to create admin users, access stored credentials and API tokens, modify platform configuration, and execute arbitrary commands across all Wazuh-managed agents. No public exploit has been identified at time of analysis; the vendor-released fix is confirmed in version 4.14.5.

HIGH

7.7

0.3%

59

PoC

CVE-2026-46343

Arbitrary file deletion on a Wazuh manager via the cluster synchronization protocol allows a cluster-authenticated attacker to destroy critical files including ossec.conf, jwt_secret.json, and TLS certificates, effectively disabling the manager or invalidating all API authentication tokens. The flaw spans Wazuh 4.0.0 through 4.14.5 and the 5.0.0-beta2 pre-release, rooted in missing path canonicalization inside the cluster file-receive cleanup handler. No public exploit or active exploitation has been identified at time of analysis; however, CVSS 4.0 rates the vulnerable-system impact as High across confidentiality, integrity, and availability, making this a high-priority patch for any clustered Wazuh deployment.

HIGH

7.5

0.3%

58

PoC

CVE-2026-54085

Argument injection in Wazuh active response scripts (versions 4.2.0-4.14.6) allows a low-privileged network attacker who controls a monitored log source to inject arbitrary arguments into firewall and account-management commands executing as root. Five scripts handling the srcip alert field (route-null.c, netsh.c, pf.c, npf.c, ipfw.c) omit IP format validation, and disable-account.c passes the dstuser field to passwd/chuser with only a root-name check, enabling injection into pfctl, npfctl, ipfw, route, netsh, and passwd. On Windows, unquoted CreateProcess concatenation in wpopenv() amplifies the impact by allowing space-delimited srcip values to append additional process arguments. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV.

HIGH

7.1

0.2%

56

PoC No patch

CVE-2026-61783

Cluster secret exposure in Wazuh 4.14.0-4.14.6 stems from a logic inversion in the RBAC masking gate that counterintuitively makes hardened accounts more exposed than default ones. Any authenticated low-privilege user whose role includes an explicit DENY on config-update actions can issue a single GET request to the manager configuration API with `raw=true` and receive the full `ossec.conf` XML with `cluster.key` in cleartext - because the broken gate treats the mere presence of a deny-rule entry as proof of update permission, disabling masking entirely. No public exploit has been identified at time of analysis, but the fix is available in 4.14.7 and the root cause is confirmed by vendor advisory and merged commit.

HIGH

7.0

0.2%

55

PoC No patch

CVE-2026-49441

Path-traversal-driven remote code execution in Wazuh 4.3.0 through 4.14.5 (and 5.0.0-beta1/beta2) lets a cluster peer that holds the shared Fernet key overwrite security-sensitive files on the master node. Because the non-merged branch of process_files_from_worker() in master.py trusts the peer-supplied file_path from files_metadata.json without confining it under the directory implied by cluster_item_key, an attacker can replace /var/ossec/etc/ossec.conf to configure root-executed commands and gain code execution on the next service reload. No public exploit identified at time of analysis, but a vendor fix and the fixing commit are public, making the root cause easy to study.

CRITICAL

9.1

0.7%

46

CVE-2026-41424

Privilege escalation in Wazuh 4.9.0-4.10.3 and 4.11.0-4.14.5 allows any authenticated user holding the users_admin role to overwrite the password of protected built-in administrator accounts - including the wazuh superuser - via a logic flaw in the PUT /security/users/{user_id} REST API endpoint. The API controller passes request.get("user"), which resolves to None because that key is absent from the request object, instead of extracting the authenticated principal from the JWT token; remove_nones_to_dict() then silently strips the None before it reaches the reserved-account authorization guard in the framework layer, causing the protection check to fail open. The issue is confirmed fixed in v4.10.4 and v4.14.6; no public exploit code or CISA KEV listing has been identified at time of analysis.

HIGH

8.2

0.3%

41

CVE-2026-45798

Stack-based buffer overflow in Wazuh's wazuh-authd enrollment daemon (versions 4.5.0 through 4.14.5 and 5.0.0-beta1) allows unauthenticated remote attackers to crash the service by sending a crafted nine-byte version string in the enrollment 'V:' field, triggering unsafe stack memory reads and a null byte write into adjacent stack frames. The vulnerable code path in compare_wazuh_versions() is reachable before authentication over TCP port 1515 when anonymous TLS enrollment is enabled, resulting in a denial of service against the agent enrollment service. No active exploitation has been confirmed (not in CISA KEV) and no public proof-of-concept has been identified at time of analysis; vendor-released patches are available in versions 4.14.6 and 5.0.0-beta2.

HIGH

7.5

0.9%

38

CVE-2026-74039

CPU exhaustion in Wazuh Manager 4.0.0-4.14.6 and 5.0.0-beta2 allows authenticated API users with the allow_run_as permission to fully deny service to all other API consumers by submitting arbitrarily deeply nested JSON to the POST /security/user/authenticate/run_as endpoint. The API framework processes these structures recursively without any depth or size limit, consuming CPU proportionally to nesting depth until the process becomes unresponsive. No public exploit identified at time of analysis, though the attack primitive is trivially constructible from the CVE description alone.

HIGH

7.1

0.3%

36

CVE-2026-74044

Path traversal via unsanitized cluster node names in Wazuh Manager 4.0.0 through 4.14.5 enables authenticated cluster peers to delete arbitrary directory contents on the master node. An attacker holding a valid cluster Fernet key can supply a traversal-shaped node name (e.g., '../../etc') in the cluster hello handshake, then disconnect - causing the master's peer cleanup routine to recursively remove the contents of directories outside the intended cluster queue path, writable by the wazuh user. No public exploit has been identified at time of analysis, and a vendor patch is available in 4.14.6.

HIGH

7.0

0.4%

35

CVE-2026-74038

Path traversal in Wazuh Manager 4.0.0 through 4.14.5 allows unauthenticated remote attackers to destroy the manager's queue directory structure and halt all Wazuh services by registering an agent whose name begins with a dot (e.g., ".."). Two compounding weaknesses drive the impact: OS_IsValidName() failed to reject dot-prefixed agent names, and delete_diff() performs unsafe path concatenation that resolves the traversal sequence to the parent queue directory, wiping its subdirectories. Recovery requires manual intervention, creating a complete and sustained loss of SIEM and XDR visibility. No public exploit or CISA KEV listing has been identified at time of analysis.

HIGH

7.0

0.4%

35

Severity Breakdown

Monthly CVE Trend

Affected Products (9)

Top Risky CVEs