CVE-2026-25769

CRITICAL LAB

Wazuh Cluster vulnerable to Remote Code Execution via Insecure Deserialization

Title source: cna

Description

Wazuh is a free and open source platform used for threat prevention, detection, and response. Versions 4.0.0 through 4.14.2 have a Remote Code Execution (RCE) vulnerability due to Deserialization of Untrusted Data). All Wazuh deployments using cluster mode (master/worker architecture) and any organization with a compromised worker node (e.g., through initial access, insider threat, or supply chain attack) are impacted. An attacker who gains access to a worker node (through any means) can achieve full RCE on the master node with root privileges. Version 4.14.3 fixes the issue.

Exploits (4)

nomisec WORKING POC 2 stars
by hakaioffsec · poc
https://github.com/hakaioffsec/CVE-2026-25769
nomisec WRITEUP
by 0xBlackash · poc
https://github.com/0xBlackash/CVE-2026-25769
nomisec SUSPICIOUS
by njeru-codes · poc
https://github.com/njeru-codes/CVE-2026-25769
nomisec WORKING POC
by Samres27 · poc
https://github.com/Samres27/CVE-2026-25769---CVE-2026-25770

References (2)

Scores

CVSS v3 9.1
EPSS 0.0032
EPSS Percentile 55.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Lab Environment

COMMUNITY
Community Lab
docker pull wazuh/wazuh-manager:4.9.2
docker pull wazuh/wazuh-manager:4.14.0
+1 more repos

Details

CWE
CWE-502
Status published
Products (2)
wazuh/wazuh 4.0.0 - 4.14.3
wazuh/wazuh >= 4.0.0, < 4.14.3
Published Mar 17, 2026
Tracked Since Mar 18, 2026