CVE-2025-24016criticalunder attackCWE-502

CVE-2025-24016: critical vulnerability in wazuh

Remote code execution in Wazuh server

Published · Updated

Follow this CVE+ Monitor wazuh+ Monitor Wazuh Server

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.9epss 94%
from disclosure to weapon3 days
Published on NVDFeb 10
1st PoC+3d
metasploitFeb 10
CISA KEV+120d
Action required by CISAfederal deadline: 2025-07-01

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

Wazuh servers before version 4.9.1 have a flaw that allows attackers with API access to run malicious code by sending specially crafted requests. This happens because the server unsafely processes data without proper validation.

Technical detail

CVE-2025-24016 is an unsafe deserialization vulnerability in Wazuh's DistributedAPI layer (framework/wazuh/core/cluster/common.py) where the `as_wazuh_object` function processes JSON-serialized parameters without sanitization. An attacker with API access (via compromised dashboard, cluster nodes, or agents in certain configurations) can inject a malicious dictionary containing an `__unhandled_exc__` exception object to achieve arbitrary Python code execution on the Wazuh server. The vulnerability affects versions 4.4.0 through 4.9.0.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.4.0 and prior to version 4.9.1, an unsafe deserialization vulnerability allows for remote code execution on Wazuh servers. DistributedAPI parameters are a serialized as JSON and deserialized using `as_wazuh_object` (in `framework/wazuh/core/cluster/common.py`). If an attacker manages to inject an unsanitized dictionary in DAPI request/response, they can forge an unhandled exception (`__unhandled_exc__`) to evaluate arbitrary python code. The vulnerability can be triggered by anybody with API access (compromised dashboard or Wazuh servers in the cluster) or, in certain configurations, even by a compromised agent. Version 4.9.1 contains a fix.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H
Affected products
wazuh · wazuh
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — wazuh

In the same product, most dangerous first.

CVE-2023-50260HIGHWazuh's vulnerability in host_deny AR script allows arbitrary command executionEPSS 41.2%CVE-2026-25769CRITICALWazuh Cluster vulnerable to Remote Code Execution via Insecure DeserializationEPSS 9.1%CVE-2024-32038CRITICALWazuh Analysis Engine Event Decoder Heap-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 1.0%CVE-2026-25770CRITICALWazuh has Privilege Escalation to Root via Cluster Protocol File WriteEPSS 1.0%CVE-2026-61800CRITICALWazuh cluster worker file sync allows arbitrary file write under /var/ossec (incomplete fix for CVE-2026-30893)EPSS 1.0%CVE-2026-45798HIGHWazuh: Pre-auth stack-buffer-overflow in compare_wazuh_versions reachable from wazuh-authd (TCP/1515) via crafted enrollment V: fieldEPSS 0.9%