High severity · published Oct 29, 2025
CVE-2025-62791
Wazuh is a free and open source platform used for threat prevention, detection, and response
7.5
CVSS
0.3%
EPSS
No
On KEV
Description
Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to 4.11.0, DecodeCiscat() implementation does not check the return the value of cJSON_GetObjectItem() for a possible NULL value in case of an error. A compromised agent can cause a crash of analysisd by sending a specially crafted message to the wazuh manager. An attacker who is able to craft and send an agent message to the wazuh manager can cause analysisd to crash and make it unavailable. This vulnerability is fixed in 4.11.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WA
Wazuh · Wazuh
before 4.11.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-62791
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-62791
Vendor Advisory
https://github.com/wazuh/wazuh/security/advisories/GHSA-gcwf-6p6m-gvm7
More from Wazuh
9.9
CVE-2025-24016
Remote code execution in Wazuh server
9.9
CVE-2026-30893
Wazuh cluster sync path traversal in decompress_files() enables arbitrary file write and code execution from authenticated cluster peer
9.8
CVE-2024-32038
Wazuh is a free and open source platform used for threat prevention, detection, and response
9.8
CVE-2021-44079
In the wazuh-slack active response script in Wazuh 4.2.x before 4.2.5, untrusted user agents are passed to a curl command line, potentially resulting in remote code execution
9.3
CVE-2026-67308
Wazuh GitHub Actions Shell Injection via Fork Pull Request