Wazuh Cluster vulnerable to Remote Code Execution via Insecure Deserialization
Title source: cnaExploitation Summary
EIP tracks 5 public exploits for CVE-2026-25769. PoCs published by adminlove520, hakaioffsec, 0xBlackash.
AI-analyzed exploit summary The repository contains only a README.md file with minimal information about CVE-2026-25769, lacking any exploit code or technical details. It describes the vulnerability as an RCE in Wazuh but provides no further analysis or proof-of-concept.
Description
Wazuh is a free and open source platform used for threat prevention, detection, and response. Versions 4.0.0 through 4.14.2 have a Remote Code Execution (RCE) vulnerability due to Deserialization of Untrusted Data). All Wazuh deployments using cluster mode (master/worker architecture) and any organization with a compromised worker node (e.g., through initial access, insider threat, or supply chain attack) are impacted. An attacker who gains access to a worker node (through any means) can achieve full RCE on the master node with root privileges. Version 4.14.3 fixes the issue.
Exploits (5)
The repository contains only a README.md file with minimal information about CVE-2026-25769, lacking any exploit code or technical details. It describes the vulnerability as an RCE in Wazuh but provides no further analysis or proof-of-concept.
This repository contains a functional exploit for CVE-2026-25769, demonstrating remote code execution via insecure deserialization in Wazuh Cluster. The PoC leverages a crafted payload to execute arbitrary commands on vulnerable Wazuh instances.
This repository provides a detailed technical analysis of CVE-2026-25769, an insecure deserialization vulnerability in Wazuh cluster mode that allows a compromised worker node to achieve root RCE on the master node. It includes attack paths, mitigation steps, detection logic, and risk assessment.
The repository lacks exploit code and provides minimal technical details about CVE-2026-25769, focusing instead on vague descriptions of Wazuh and the vulnerability without depth.
This repository contains a functional PoC for CVE-2026-25769 and CVE-2026-25770, which exploit deserialization and file write vulnerabilities in Wazuh cluster configurations. The PoC includes Docker setup and exploit scripts to demonstrate RCE on the master node via worker communication.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H