Critical severity · published Feb 10, 2025
CVE-2025-24016
Remote code execution in Wazuh server
In wildKEV
9.9
CVSS
93.8%
EPSS
Yes
On KEV
Description
Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.4.0 and prior to version 4.9.1, an unsafe deserialization vulnerability allows for remote code execution on Wazuh servers. DistributedAPI parameters are a serialized as JSON and deserialized using `as_wazuh_object` (in `framework/wazuh/core/cluster/common.py`). If an attacker manages to inject an unsanitized dictionary in DAPI request/response, they can forge an unhandled exception (`__unhandled_exc__`) to evaluate arbitrary python code. The vulnerability can be triggered by anybody with API access (compromised dashboard or Wazuh servers in the cluster) or, in certain configurations, even by a compromised agent. Version 4.9.1 contains a fix.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)93.8% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Jun 10, 2025
Federal remediation dueJul 1, 2025
Ransomware campaign useNot known
Affected products
Which versions
WA
wazuh · wazuh
>= 4.4.0, < 4.9.1 · source: vendor, NVD
WS
Wazuh Server · Wazuh
All versions, or not specified · source: KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-24016
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-24016
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
x_refsource_CONFIRM
https://github.com/wazuh/wazuh/security/advisories/GHSA-hcrc-79hj-m3qh
More from wazuh
9.9
CVE-2026-30893
Wazuh cluster sync path traversal in decompress_files() enables arbitrary file write and code execution from authenticated cluster peer
9.8
CVE-2024-32038
Wazuh is a free and open source platform used for threat prevention, detection, and response
9.8
CVE-2021-44079
In the wazuh-slack active response script in Wazuh 4.2.x before 4.2.5, untrusted user agents are passed to a curl command line, potentially resulting in remote code execution
9.3
CVE-2026-67308
Wazuh GitHub Actions Shell Injection via Fork Pull Request
9.1
CVE-2026-61800
Wazuh cluster worker file sync allows arbitrary file write under /var/ossec (incomplete fix for CVE-2026-30893)