CVE-2026-25770 - Vulnerability Analysis

Overview

Wazuh 3.9.0 to <4.14.3 contains a privilege escalation caused by insecure cluster synchronization protocol allowing authenticated nodes to write arbitrary files and inject commands in ossec.conf, letting attackers with cluster credentials achieve root remote code execution.

Severity & Score

Impact

Attackers with cluster credentials can execute arbitrary code as root, leading to full system compromise.

Mitigation

Upgrade to version 4.14.3 or later.

References

• https://github.com/wazuh/wazuh/security/advisories/GHSA-r4f7-v3p6-79jm

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 17, 2026

🔴 CVE-2026-25770 - Critical (9.1) Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 3.9.0 and prior to version 4.14.3, a privilege escalation vulnerability exists in the Wazuh Manager's cluster synchronization protoco... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25770/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner