55
CVEs
10
Critical
20
High
0
KEV
15
PoC
9
Unpatched C/H
65.5%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
10
HIGH
20
MEDIUM
24
LOW
1
Monthly CVE Trend
Affected Products (9)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-48024 | Path-traversal-driven root code execution affects the Wazuh security platform's cluster synchronization layer in versions 4.0.0 through 4.14.5 and the 5.0.0-beta line up to 5.0.0-beta3. A malicious or compromised cluster peer that possesses the shared Fernet key can smuggle directory-traversal sequences through merge_type/name values or a merged-file header, causing the master node to write attacker-controlled files (e.g. /var/ossec/etc/ossec.conf) outside the intended cluster item directory; overwriting ossec.conf lets the attacker define root-executed commands that fire when Wazuh services reload. No public exploit has been identified at time of analysis, and the issue is not in CISA KEV; the vendor fix landed in 4.14.6 and 5.0.0-beta3. | CRITICAL | 9.1 | 0.8% | 66 |
PoC
|
| CVE-2026-48162 | Arbitrary file read in Wazuh cluster deployments (4.0.0 through 4.14.5, and 5.0.0-beta1/beta2) lets a peer node that already holds the shared cluster Fernet key coerce the master into returning any file it can read over the encrypted cluster channel. By retrieving /var/ossec/api/configuration/security/private_key.pem, that peer can forge administrator REST API tokens offline and exercise full administrative privileges without ever creating an account. No public exploit identified at time of analysis; the underlying fix is confirmed in the vendor advisory and shipped in 4.14.6 and 5.0.0-beta3. | CRITICAL | 9.1 | 0.6% | 66 |
PoC
|
| CVE-2026-61800 | Arbitrary file write leading to root remote code execution affects Wazuh worker nodes in clustered deployments running versions 4.4.0 through 4.14.6. A peer that possesses the shared cluster key can abuse the file-synchronization routine to drop, overwrite, or delete files at attacker-chosen paths under /var/ossec - including scripts executed as root - because the worker's non-merged sync branch never verifies that a synced file matches the directory declared by its cluster_item_key. This is an incomplete fix for CVE-2026-30893, and no public exploit has been identified at time of analysis; it is fixed in 4.14.7. | CRITICAL | 9.1 | 0.6% | 66 |
PoC
No patch
|
| CVE-2026-25769 | A critical deserialization vulnerability in Wazuh's cluster mode allows attackers with access to any worker node to achieve remote code execution with root privileges on the master node. The vulnerability affects Wazuh versions 4.0.0 through 4.14.2 and poses severe risk to organizations using Wazuh in distributed deployments, as compromise of any single worker node can lead to full cluster takeover. While no active exploitation has been reported (not in KEV), proof-of-concept materials are publicly available via the Google Drive link in the advisory. | CRITICAL | 9.1 | 0.4% | 66 |
PoC
|
| CVE-2026-44901 | Remote code execution on the Wazuh cluster master node is achievable by any attacker who controls a cluster worker node, exploiting unsafe Python builtin resolution in the distributed API merge path. Affected versions span 4.0.0 through 4.14.5 and 5.0.0-beta1; the vulnerable code in framework/wazuh/core/results.py called getattr(builtins, type_) with attacker-supplied strings from worker JSON responses, enabling exec or eval injection. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the attack primitive is mechanically trivial once a worker node is controlled, with the payload executing as root on the master. | HIGH | 8.4 | 0.7% | 63 |
PoC
|
| CVE-2026-54083 | Path traversal in Wazuh's ip-customblock active response script allows low-privileged remote attackers to create or delete arbitrary files as root by injecting directory traversal sequences into the srcip field of alert-triggering log events. Versions prior to 4.14.7 are affected when ip-customblock is configured as an active response - the block action creates an empty file at an attacker-controlled path, while the unblock action deletes it, both executing as root and enabling destruction of credentials, configuration, or other critical files. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog, though the missing validation is trivially observable by comparing ip-customblock.c against its sibling scripts. | HIGH | 8.1 | 0.3% | 61 |
PoC
No patch
|
| CVE-2026-44252 | Cluster key disclosure in Wazuh Manager versions 4.0.0 through 4.14.4 enables a two-stage privilege escalation: a low-privilege API user with manager:read permission can retrieve the plaintext Fernet cluster key via the raw configuration endpoint, then use it to impersonate a cluster worker node and inject attacker-controlled RBAC permissions that grant full administrative access. The master node's unconditional trust in worker-supplied authorization context (CWE-863 - Incorrect Authorization) allows an attacker to create admin users, access stored credentials and API tokens, modify platform configuration, and execute arbitrary commands across all Wazuh-managed agents. No public exploit has been identified at time of analysis; the vendor-released fix is confirmed in version 4.14.5. | HIGH | 7.7 | 0.3% | 59 |
PoC
|
| CVE-2026-46343 | Arbitrary file deletion on a Wazuh manager via the cluster synchronization protocol allows a cluster-authenticated attacker to destroy critical files including ossec.conf, jwt_secret.json, and TLS certificates, effectively disabling the manager or invalidating all API authentication tokens. The flaw spans Wazuh 4.0.0 through 4.14.5 and the 5.0.0-beta2 pre-release, rooted in missing path canonicalization inside the cluster file-receive cleanup handler. No public exploit or active exploitation has been identified at time of analysis; however, CVSS 4.0 rates the vulnerable-system impact as High across confidentiality, integrity, and availability, making this a high-priority patch for any clustered Wazuh deployment. | HIGH | 7.5 | 0.3% | 58 |
PoC
|
| CVE-2026-54085 | Argument injection in Wazuh active response scripts (versions 4.2.0-4.14.6) allows a low-privileged network attacker who controls a monitored log source to inject arbitrary arguments into firewall and account-management commands executing as root. Five scripts handling the srcip alert field (route-null.c, netsh.c, pf.c, npf.c, ipfw.c) omit IP format validation, and disable-account.c passes the dstuser field to passwd/chuser with only a root-name check, enabling injection into pfctl, npfctl, ipfw, route, netsh, and passwd. On Windows, unquoted CreateProcess concatenation in wpopenv() amplifies the impact by allowing space-delimited srcip values to append additional process arguments. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV. | HIGH | 7.1 | 0.2% | 56 |
PoC
No patch
|
| CVE-2026-61783 | Cluster secret exposure in Wazuh 4.14.0-4.14.6 stems from a logic inversion in the RBAC masking gate that counterintuitively makes hardened accounts more exposed than default ones. Any authenticated low-privilege user whose role includes an explicit DENY on config-update actions can issue a single GET request to the manager configuration API with `raw=true` and receive the full `ossec.conf` XML with `cluster.key` in cleartext - because the broken gate treats the mere presence of a deny-rule entry as proof of update permission, disabling masking entirely. No public exploit has been identified at time of analysis, but the fix is available in 4.14.7 and the root cause is confirmed by vendor advisory and merged commit. | HIGH | 7.0 | 0.2% | 55 |
PoC
No patch
|
| CVE-2026-56699 | NDJSON injection in Wazuh Manager before 5.0.0-beta3 lets any enrolled agent smuggle arbitrary OpenSearch bulk operations because the DataValue.index field is not escaped when the manager builds inventory-sync bulk requests. Because those requests execute under the manager's OpenSearch admin credentials, a single low-trust agent can delete documents, tamper with alerts, and manipulate SIEM state across all other agents. Rated CVSS 10.0 by the reporter (VulnCheck); no public exploit identified at time of analysis and it is not listed in CISA KEV. | CRITICAL | 10.0 | 0.4% | 50 |
|
| CVE-2026-49441 | Path-traversal-driven remote code execution in Wazuh 4.3.0 through 4.14.5 (and 5.0.0-beta1/beta2) lets a cluster peer that holds the shared Fernet key overwrite security-sensitive files on the master node. Because the non-merged branch of process_files_from_worker() in master.py trusts the peer-supplied file_path from files_metadata.json without confining it under the directory implied by cluster_item_key, an attacker can replace /var/ossec/etc/ossec.conf to configure root-executed commands and gain code execution on the next service reload. No public exploit identified at time of analysis, but a vendor fix and the fixing commit are public, making the root cause easy to study. | CRITICAL | 9.1 | 0.7% | 46 |
|
| CVE-2026-28220 | Authenticated remote code execution in Wazuh's Cluster Distributed API (DAPI) lets any peer holding the shared cluster key coerce the master node into deserializing an attacker-controlled callable (CWE-502) and running it under a forged RBAC context, yielding full manager compromise. Rated CVSS 9.1 and affecting all cluster deployments from 4.0.0 up to the 4.14.5 fix, it combines an overly broad deserialization allowlist with client-controlled authorization to bypass permission checks entirely. SSVC records a proof-of-concept, so publicly available exploit code exists, though EPSS remains low at 0.19% (9th percentile), consistent with a signal that requires possession of the cluster key rather than opportunistic mass exploitation. | CRITICAL | 9.1 | 0.2% | 46 |
|
| CVE-2026-25770 | Privilege escalation in Wazuh Manager versions 3.9.0 through 4.14.2 allows authenticated cluster nodes to achieve unauthenticated root code execution by exploiting insecure file permissions in the cluster synchronization protocol. An attacker with cluster node access can overwrite the manager's configuration file to inject malicious commands that are subsequently executed with root privileges by the logcollector service. This vulnerability affects multi-node Wazuh deployments and has no available patch. | CRITICAL | 9.1 | 0.1% | 46 |
|
| CVE-2026-30893 | Wazuh Manager (4.4.0 through 4.14.3) contains a path traversal vulnerability in the cluster synchronization routine that allows an authenticated cluster peer to write arbitrary files outside the intended extraction directory on other cluster nodes. Writing to sensitive locations such as cron directories or Python module paths leads to remote code execution. CVSS 9.0 Critical (network-accessible, high privilege required, scope changed). Patch available in v4.14.4; no active exploitation identified. | CRITICAL | 9.0 | 0.1% | 45 |
PoC
|