CVE-2026-25769 - Vulnerability Analysis

Overview

Wazuh 4.0.0 through 4.14.2 contains a remote code execution caused by deserialization of untrusted data in cluster mode, letting attackers with access to a worker node execute code as root on the master node, exploit requires compromised worker node access.

Severity & Score

Impact

Attackers with access to a worker node can execute code as root on the master node, leading to full system compromise.

Mitigation

Upgrade to version 4.14.3 or later.

References

• https://drive.google.com/drive/folders/1WlkKNmHexz8212OVED9O6M_3pI8b6qNI?usp=sharing
• https://github.com/wazuh/wazuh/security/advisories/GHSA-3gm7-962f-fxw5

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 17, 2026

🔴 CVE-2026-25769 - Critical (9.1) Wazuh is a free and open source platform used for threat prevention, detection, and response. Versions 4.0.0 through 4.14.2 have a Remote Code Execution (RCE) vulnerability due to Deserialization of Untrusted Data). All Wazuh deployments using clu... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25769/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

GitHub Repositories(1 repo)

• https://github.com/hakaioffsec/CVE-2026-25769

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner