Remote code execution in Wazuh server

Wazuh cluster sync path traversal in decompress_files() enables arbitrary file write and code execution from authenticated cluster peer

Wazuh is a free and open source platform used for threat prevention, detection, and response

In the wazuh-slack active response script in Wazuh 4.2.x before 4.2.5, untrusted user agents are passed to a curl command line, potentially resulting in remote code execution

Wazuh GitHub Actions Shell Injection via Fork Pull Request

Wazuh cluster worker file sync allows arbitrary file write under /var/ossec (incomplete fix for CVE-2026-30893)

Wazuh : peer-controlled metadata key in process_files_from_worker non-merged branch allows arbitrary file write under WAZUH_PATH on Wazuh manager

Wazuh: merged-file header path traversal in cluster sync allows arbitrary file write under WAZUH_PATH in Wazuh manager

Wazuh: cluster peer can read arbitrary master files and forge offline REST API administrator tokens via DAPI tmp_file path injection in Wazuh manager

Wazuh cluster DAPI arbitrary callable deserialization and RBAC context injection allow a cluster peer to execute privileged functions on the master node

Wazuh Cluster vulnerable to Remote Code Execution via Insecure Deserialization

Wazuh NetNTLMv2 Hash Theft In Multiple Centralized Configuration Capabilities

Wazuh Manager dapi RBAC Bypass Allows Privilege Escalation

Wazuh is a free and open source platform used for threat prevention, detection, and response

Wazuh v3.6.1 - v3.13.5, v4.0.0 - v4.2.7, and v4.3.0 - v4.3.7 were discovered to contain an authenticated remote code execution (RCE) vulnerability via the Active Response endpoint

Wazuh API in Wazuh from 4.0.0 to 4.0.3 allows authenticated users to execute arbitrary code with administrative privileges via /manager/files URI

Wazuh Cluster DAPI Protocol Deserialization of Untrusted Data Remote Code Execution Vulnerability

Wazuh: Privilege Escalation via Admin-Protection Bypass in update-user API Endpoint

Wazuh: Pre-auth stack-based buffer overflow in wazuh-remoted print_hex_string() due to signed char promotion on x86_64

Wazuh: Path traversal in ip-customblock active response allows arbitrary file creation and deletion

Wazuh Provisioning Scripts / Build Infrastructure Improper Certificate Validation leading to MITM and RCE

Wazuh GitHub Actions Workflow Exposure of Sensitive Credentials

Wazuh Vulnerable to Heap-based Buffer Out-Of-Bounds WRITE in decode_win_permissions

Wazuh is a free and open source platform used for threat prevention, detection, and response

Wazuh: Heap-based Buffer Overflow in syscheck Registry Wildcard Expansion (LPE / DoS)

Wazuh is a free and open source platform used for threat prevention, detection, and response

Wazuh is a free and open source platform used for threat prevention, detection, and response

The agent in OSSEC through 3.1.0 on Windows allows local users to gain NT AUTHORITY\SYSTEM access via Directory Traversal by leveraging full access to the associated OSSEC server

Wazuh before 5.0.0-beta3 Cluster Attribution Spoofing via Inventory Sync

Wazuh Manager cluster header parsing allows pre-authentication memory exhaustion

Wazuh: Pre-auth stack-buffer-overflow in compare_wazuh_versions reachable from wazuh-authd (TCP/1515) via crafted enrollment V: field

Wazuh: Unauthenticated Path Traversal in authd via Agent Group Name

Wazuh: Heap buffer overflow in wazuh-analysisd via rootcheck event parsing

Wazuh Manager authd service Improper SSL/TLS Renegotiation Handling leading to Denial of Service

SSL/TLS Renegotiation DoS in Wazuh Manager authd service

Wazuh Vulnerable to Denial of Service via Synchronous I/O Blocking in Asynchronous Authentication Middleware

Wazuh vulnerable to Heap-based Buffer Over-read in w_expression_match

Wazuh vulnerable to NULL pointer dereference in DecodeCiscat

Wazuh vulnerable to NULL pointer dereference in fim_fetch_attributes_state

Wazuh vulnerable to NULL pointer dereference in fim_alert line 712

Wazuh Vulnerable to Heap Use After Free in w_copy_event_for_log

Wazuh Vulnerable to Heap-based Buffer Over-read in DecodeWinevt

Wazuh fillData NULL pointer dereference causes analysisd crash

Wazuh: Arbitrary File Deletion via Cluster Protocol – Incomplete Path Validation in end_receiving_file()

Wazuh Agent and Manager OS Command Injection and Untrusted Search Path

Wazuh has Stack-Based Buffer Overflow in Security Configuration Assessment JSON Parser

Wazuh Database Synchronization Vulnerable to Stack-based Buffer Overflow via snprintf Integer Underflow

Wazuh has Privilege Escalation to Root via Cluster Protocol File Write

Improper input validation in the Wazuh agent for Windows prior to version 4.8.0 allows an attacker with control over the Wazuh server or agent key to configure the agent to…

Wazuh: Missing input validation in multiple active response scripts allows argument injection