23 matches found
CVE-2025-24016-Wazuh-Remote-Code-Execution-RCE-PoC
🚨 Wazuh 원격 코드 실행 RCE - PoC 📌 취약점 요약 Wazuh 서버에서 wazuh-manager 패키지의 안전하지 않은 역직렬화로 인해 심각한 RCE 취약점이 확인되었습니다. 이 버그는 Wazuh 버전 ≥ 4.4.0에 영향을 미치며 버전 4.9.1에서 패치되었습니다. 🔍 세부 정보 이 결함은 Wazuh API의 DistributedAPI에 존재하며, 사용자 제어 입력이 안전하지 않게 역직렬화됩니다. 이로 인해 API 접근 권한이 있는 공격자예: 손상된 대시보드 또는 클러스터 노드가 runas 엔드포인트를 사용하여...
Wazuh Server 4.4.0 < 4.14.6 Log Injection (CVE-2026-44256)
The version of Wazuh Server on the remote host is at least 4.4.0 and prior to 4.14.6. It is, therefore, affected by a log injection vulnerability: - The Basic authentication username is decoded before credential validation and passed to the access logger without neutralizing control characters. A...
Wazuh Server 3.9.0 < 4.14.5 DoS (CVE-2026-44253)
The version of Wazuh Server on the remote host is at least 3.9.0 and prior to 4.14.5. It is, therefore, affected by a denial of service vulnerability: - The cluster protocol allows an authenticated cluster node to exhaust memory on the master. The receivestr method accepts an attacker-controlled...
Wazuh Server 4.9.0 < 4.10.4 / 4.11.0 < 4.14.6 Incorrect Authorization (CVE-2026-41424)
The version of Wazuh Server on the remote host is 4.9.0 prior to 4.10.4, or 4.11.0 prior to 4.14.6. It is, therefore, affected by an incorrect authorization vulnerability: - PUT /security/users/userid passes request.get'user' instead of request.context'tokeninfo''sub' as currentuser. An...
Wazuh Server 4.3.0 < 4.14.6 Path Traversal (CVE-2026-49441)
The version of Wazuh Server on the remote host is at least 4.3.0 and prior to 4.14.6. It is, therefore, affected by a path traversal vulnerability: - The non-merged branch of processfilesfromworker trusts a peer-controlled filepath key from filesmetadata.json. A cluster peer holding the shared...
Wazuh Server 4.6.0 < 4.14.6 SQL Injection (CVE-2026-49392)
The version of Wazuh Server on the remote host is at least 4.6.0 and prior to 4.14.6. It is, therefore, affected by a SQL injection vulnerability: - DB::getFile and DB::searchFile concatenate a monitored file path into SQLite row filters without proper escaping on non-Windows systems. A local use...
Wazuh Server 4.0.0 < 4.14.5 Incorrect Authorization (CVE-2026-44252)
The version of Wazuh Server on the remote host is at least 4.0.0 and prior to 4.14.5. It is, therefore, affected by an incorrect authorization vulnerability: - A low-privilege read-only API user with manager:read permission can retrieve the cluster key from ossec.conf. An attacker can use the...
Wazuh Server 4.5.0 < 4.14.6 Stack Buffer Overflow (CVE-2026-45798)
The version of Wazuh Server on the remote host is at least 4.5.0 and prior to 4.14.6. It is, therefore, affected by a stack buffer overflow vulnerability: - comparewazuhversions copies the attacker-controlled enrollment V: field into a 10-byte stack buffer without explicit null termination. A...
Wazuh Server 4.0.0 < 4.14.6 Multiple Vulnerabilities
The version of Wazuh Server on the remote host is at least 4.0.0 and prior to 4.14.6. It is, therefore, affected by multiple vulnerabilities, including: - cluster.unmergeinfo constructs paths from peer-controlled mergetype and name values in a merged synchronization archive. A cluster peer holdin...
Wazuh Server 1.0.0 < 4.14.6 Out-of-Bounds Write (CVE-2026-44254)
The version of Wazuh Server on the remote host is at least 1.0.0 and prior to 4.14.6. It is, therefore, affected by an out-of-bounds write vulnerability: - HandleSecureMessage passes a pointer inside its stack buffer to ReadSecMSG, which decompresses up to OSMAXSTR bytes at that offset. An...
CVE-2026-26206 Wazuh: API brute-force protection bypass via race condition in login attempt tracking
Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.0.0 to before version 4.14.4, Wazuh's server API brute-force protection for POST /security/user/authenticate can be bypassed by sending concurrent authentication requests. Although the...
Wazuh Server 4.0.0 < 4.14.3 RCE
The version of Wazuh Server on the remote host is at least 4.0.0 and prior to 4.14.3. It is, therefore, affected by a remote code execution vulnerability: - A deserialization of untrusted data vulnerability exists in Wazuh's cluster mode master/worker architecture. An attacker who gains access to...
📄 Wazuh Server Remote Code Execution
Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.4.0 and prior to version 4.9.1, an unsafe deserialization vulnerability allows for remote code execution on Wazuh servers. DistributedAPI parameters are serialized as JSON and...
Two Distinct Botnets Exploit Wazuh Server Vulnerability to Launch Mirai-Based Attacks
A now-patched critical security flaw in the Wazur Server is being exploited by threat actors to drop two different Mirai botnet variants and use them to conduct distributed denial-of-service DDoS attacks. Akamai, which first discovered the exploitation efforts in late March 2025, said the malicio...
Two Distinct Botnets Exploit Wazuh Server Vulnerability to Launch Mirai-Based Attacks
A now-patched critical security flaw in the Wazur Server is being exploited by threat actors to drop two different Mirai botnet variants and use them to conduct distributed denial-of-service DDoS attacks. Akamai, which first discovered the exploitation efforts in late March 2025, said the malicio...
Wazuh Server 4.4.0 < 4.9.1 RCE
The version of Wazuh Server on the remote host is at least 4.4.0 and prior to 4.9.1. It is, therefore, affected by a remote code execution vulnerability: - Starting in version 4.4.0 and prior to version 4.9.1, an unsafe deserialization vulnerability allows for remote code execution on Wazuh...
Wazuh Server Installed (Linux / UNIX)
Binary data wazuhservernixinstalled.nbin...
Wazuh server vulnerable to remote code execution
Summary An unsafe deserialization vulnerability allows for remote code execution on Wazuh servers. The vulnerability can be triggered by anybody with API access compromised dashboard or Wazuh servers in the cluster or, in certain configurations, even by a compromised agent. Details DistributedAPI...
GHSA-HCRC-79HJ-M3QH Wazuh server vulnerable to remote code execution
Summary An unsafe deserialization vulnerability allows for remote code execution on Wazuh servers. The vulnerability can be triggered by anybody with API access compromised dashboard or Wazuh servers in the cluster or, in certain configurations, even by a compromised agent. Details DistributedAPI...