wazuh

4 results · Clear filters · Feed

• High 7.5
  CVE-2026-74034 Public exploit

  Wazuh 4.1.0 before 4.14.8 Arbitrary File Read via upgrade_custom Command

  Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wm_agent_upgrade that allows enrolled agents to issue upgrade_custom commands with attacker-controlled file_path. Attackers can inject an upgrade_custom message over the agent channel to read a…

  wazuh wazuh-manager
  Oct 13, 2026
• Medium 6.5
  CVE-2025-15617 Public exploit

  Wazuh GitHub Actions Workflow Exposure of Sensitive Credentials

  Wazuh version 4.12.0 contains an exposure vulnerability in GitHub Actions workflow artifacts that allows attackers to extract the GITHUB_TOKEN from uploaded artifacts. Attackers can use the exposed token within a limited time window to perform unauthorized ac…

  wazuh Wazuh (GitHub Actions)
  Mar 27, 2026
• Critical 9.1
  CVE-2026-25769 Public exploit

  Wazuh Cluster vulnerable to Remote Code Execution via Insecure Deserialization

  Wazuh is a free and open source platform used for threat prevention, detection, and response. Versions 4.0.0 through 4.14.2 have a Remote Code Execution (RCE) vulnerability due to Deserialization of Untrusted Data). All Wazuh deployments using cluster mode (m…

  wazuh wazuh
  Mar 17, 2026
• Critical 9.9
  CVE-2025-24016 Exploited Public exploit Scanner template EPSS 94%

  Remote code execution in Wazuh server

  Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.4.0 and prior to version 4.9.1, an unsafe deserialization vulnerability allows for remote code execution on Wazuh servers. DistributedAPI param…

  wazuh wazuh github.com/wazuh/wazuh Go
  Feb 10, 2025

  KEV Jun 10, 2025