CVE-2025-24016-Wazuh-Remote-Code-Execution-RCE-PoC

🚨 Wazuh Remote Code Execution RCE - PoC 📌 Vulnerability Summary A critical RCE vulnerability has been identified in the Wazuh server due to unsafe deserialization in the wazuh-manager package. This bug affects Wazuh versions ≥ 4.4.0 and has been patched in version 4.9.1. 🔍 Details The flaw lies i...

CVE-2026-93346

Wazuh from 4.0.0 before 4.14.8 contains a race condition in API login throttling that allows unauthenticated attackers to bypass maxloginattempts by sending concurrent requests. Attackers can fire concurrent login bursts to the authenticate and runas endpoints, each passing the block check before...

CVE-2026-74037

Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for runas users with zero static roles, because checktoken never consults the blacklist. Attackers with revoked administrator grants can continue authenticating and self-link the administrator role to permanently retain privileged access...

CVE-2026-93346 Wazuh 4.0.0 before 4.14.8 API Brute-Force Protection Bypass via Race Condition

Wazuh from 4.0.0 before 4.14.8 contains a race condition in API login throttling that allows unauthenticated attackers to bypass maxloginattempts by sending concurrent requests. Attackers can fire concurrent login bursts to the authenticate and runas endpoints, each passing the block check before...

CVE-2026-93346 Wazuh 4.0.0 before 4.14.8 API Brute-Force Protection Bypass via Race Condition

Wazuh from 4.0.0 before 4.14.8 contains a race condition in API login throttling that allows unauthenticated attackers to bypass maxloginattempts by sending concurrent requests. Attackers can fire concurrent login bursts to the authenticate and runas endpoints, each passing the block check before...

CVE-2026-93346

Wazuh versions 4.0.0 through 4.14.7 are vulnerable to a race condition in the API login throttling mechanism. This flaw allows unauthenticated attackers to bypass max_login_attempts by sending concurrent login bursts to the authenticate and run_as endpoints. Because each request may pass the bloc...

CVE-2026-93346 Wazuh 4.0.0 before 4.14.8 API Brute-Force Protection Bypass via Race Condition

Wazuh from 4.0.0 before 4.14.8 contains a race condition in API login throttling that allows unauthenticated attackers to bypass maxloginattempts by sending concurrent requests. Attackers can fire concurrent login bursts to the authenticate and runas endpoints, each passing the block check before...

CVE-2026-74037 Wazuh 4.0.0 before 4.14.8 Session Invalidation Bypass in check_token

Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for runas users with zero static roles, because checktoken never consults the blacklist. Attackers with revoked administrator grants can continue authenticating and self-link the administrator role to permanently retain privileged access...

CVE-2026-74037 Wazuh 4.0.0 before 4.14.8 Session Invalidation Bypass in check_token

Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for runas users with zero static roles, because checktoken never consults the blacklist. Attackers with revoked administrator grants can continue authenticating and self-link the administrator role to permanently retain privileged access...

CVE-2026-74037

Wazuh versions 4.0.0 before 4.14.8 are vulnerable to a Session Invalidation Bypass in the check_token function. The root cause is that the system fails to consult the blacklist when validating issued tokens for run_as users with zero static roles. This allows an attacker with revoked administrato...

CVE-2026-74037 Wazuh 4.0.0 before 4.14.8 Session Invalidation Bypass in check_token

Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for runas users with zero static roles, because checktoken never consults the blacklist. Attackers with revoked administrator grants can continue authenticating and self-link the administrator role to permanently retain privileged access...

CVE-2026-93346: Improper Restriction of Excessive Authentication Attempts

Wazuh from 4.0.0 before 4.14.8 contains a race condition in API login throttling that allows unauthenticated attackers to bypass maxloginattempts by sending concurrent requests. Attackers can fire concurrent login bursts to the authenticate and runas endpoints, each passing the block check before...

CVE-2026-74037: Insufficient Session Expiration

Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for runas users with zero static roles, because checktoken never consults the blacklist. Attackers with revoked administrator grants can continue authenticating and self-link the administrator role to permanently retain privileged access...

CVE-2026-74039

Wazuh 4.0.0 before 4.14.7 and 5.0.0-beta2 are vulnerable to CPU-exhaustion DoS. Authenticated attackers with allow_run_as enabled can submit arbitrarily deeply nested auth_context JSON to POST /security/user/authenticate/run_as, causing the API framework to consume excessive CPU and deny service ...

CVE-2026-74039 Wazuh 4.0.0 < 4.14.7 API DoS via Deeply Nested JSON auth_context

Wazuh 4.0.0 before 4.14.7 and 5.0.0-beta2 contain a denial of service vulnerability that allows authenticated attackers with allowrunas enabled to exhaust CPU resources by submitting arbitrarily deeply nested JSON structures to the POST /security/user/authenticate/runas endpoint. Attackers can...

CVE-2026-74039: Allocation of Resources Without Limits or Throttling

Wazuh 4.0.0 before 4.14.7 and 5.0.0-beta2 contain a denial of service vulnerability that allows authenticated attackers with allowrunas enabled to exhaust CPU resources by submitting arbitrarily deeply nested JSON structures to the POST /security/user/authenticate/runas endpoint. Attackers can...

EUVD-2017-17389

Malware in sbrugna...

ElasticSearch X-Pack Security Elevation of Privilege Vulnerability

ElasticSearch X-Pack is an extension of the Elastic Stack log analysis system from the Dutch company Elasticsearch. security is one of the features used to control access rights. An elevation of privilege vulnerability exists in the runas feature in ElasticSearch X-Pack Security versions 5.0.0...

CVE-2017-8438

Elastic X-Pack Security versions 5.0.0 to 5.4.0 contain a privilege escalation bug in the runas functionality. This bug prevents transitioning into the specified user specified in a runas request. If a role has been created using a template that contains the user properties, the behavior of runas...

Design/Logic Flaw

Elastic X-Pack Security versions 5.0.0 to 5.4.0 contain a privilege escalation bug in the runas functionality. This bug prevents transitioning into the specified user specified in a runas request. If a role has been created using a template that contains the user properties, the behavior of runas...