CVE-2026-25769
🗓️ 17 Mar 2026 17:41:08Reported by GitHub_MType 
cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 113 Views🌐 WEB
| Reporter | Title | Published | Views | Family All 22 |
|---|---|---|---|---|
 | Exploit for Deserialization of Untrusted Data in Wazuh | 13 Apr 202608:46 | – | githubexploit |
| Exploit for Deserialization of Untrusted Data in Wazuh | 11 Feb 202618:29 | – | githubexploit |
 | CVE-2026-25769 | 17 Mar 202617:41 | – | attackerkb |
 | Wazuh as_wazuh_object Code Execution | 18 Mar 202600:00 | – | bdu_fstec |
 | CVE-2026-25769 | 11 Feb 202617:00 | – | circl |
 | Wazuh security vulnerabilities | 17 Mar 202600:00 | – | cnnvd |
 | CVE-2026-25769 Wazuh Cluster vulnerable to Remote Code Execution via Insecure Deserialization | 17 Mar 202617:41 | – | cvelist |
 | EUVD-2026-12595 | 17 Mar 202617:41 | – | euvd |
 | CVE-2026-25769 | 27 Oct 202612:55 | – | kitploit |
| CVE-2026-25769 | 26 Oct 202612:58 | – | kitploit |
10
[
{
"vendor": "wazuh",
"product": "wazuh",
"versions": [
{
"version": ">= 4.0.0, < 4.14.3",
"status": "affected"
}
]
}
]| Parameter | Position | Path | Description | CWE |
|---|---|---|---|---|
| f | request body | dapi | Insecure deserialization of JSON data in the Wazuh cluster synchronization protocol. A compromised worker node can send a malicious JSON payload to the master node, which is processed by the vulnerable as_wazuh_object() function, leading to arbitrary Python code execution with root privileges. | CWE-502 |
| f_kwargs | request body | dapi | Insecure deserialization of JSON data in the Wazuh cluster synchronization protocol. A compromised worker node can send a malicious JSON payload to the master node, which is processed by the vulnerable as_wazuh_object() function, leading to arbitrary Python code execution with root privileges. | CWE-502 |
| request_type | request body | dapi | Insecure deserialization of JSON data in the Wazuh cluster synchronization protocol. A compromised worker node can send a malicious JSON payload to the master node, which is processed by the vulnerable as_wazuh_object() function, leading to arbitrary Python code execution with root privileges. | CWE-502 |
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
17 Jun 2026 10:25Current
8.4High risk
Vulners AI Score8.4
CVSS 3.19.1
EPSS0.08923
SSVC