CVE Intelligence
Analysis AI-assisted

CVE-2026-25769: Wazuh Cluster: RCE via Deserialization of Untrusted Data

CVE-2026-25769 is a critical deserialization of untrusted data flaw (CWE-502) affecting Wazuh deployments in cluster mode, where a master/worker architecture is used. According to the record, an attacker who gains access to a worker node can execute code on the master node with root privileges. The record states that version 4.14.3 fixes the issue.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-25769 is a deserialization of untrusted data flaw (CWE-502) in Wazuh cluster mode, which uses a master/worker architecture. The vendor advisory and the NVD record describe it as allowing remote code execution on the master node when an attacker has reached a worker node.

Impact

  • According to the record, successful exploitation could give full remote code execution on the master node with root privileges.
  • Deployments using cluster mode are described as affected, as are organizations where a worker node is compromised by any means, such as initial access, insider threat or supply chain attack.
  • The record assigns a CVSS base score of 9.1 (critical) and an SSVC technical impact value of total.

Affected products and versions

  • Product: Wazuh.
  • Affected range according to the record: from 4.0.0 up to and including 4.14.2.
  • Fixed in 4.14.3 according to the record description.
  • The record contains no separate fixed-version entry, so the fix version is taken from the description and the vendor advisory.

Exploitation status

  • The record shows kev.listed as false, so it does not confirm active exploitation or exploitation in the wild.
  • No confirmed exploitation appears in the sources consulted.
  • The SSVC exploitation value in the record is poc, which we read as indicating that proof-of-concept material is considered to exist; this is an inference and not evidence of attacks.
  • The EPSS probability in the record is 0.00972 with a percentile of 0.61618.

Remediation and mitigation

  • Upgrade Wazuh deployments in cluster mode to 4.14.3, as stated in the record.
  • Until patched, treat worker nodes as a trust boundary: restrict who can reach and administer them and verify their integrity.
  • Limit the impact of a compromised worker through least privilege and network segmentation between workers and the master.
  • Consult the vendor advisory for the complete guidance.

Detection guidance

  • Monitor worker nodes for unexpected administrative activity, new or modified software and unusual outbound connections.
  • Review master node logs for unexpected process or service activity linked to cluster communication.
  • Audit the list of enrolled worker nodes and investigate any that are unrecognized.

Limitations of the available information

  • The record does not describe the vulnerable code path, the specific deserialization point or the authentication requirements in detail.
  • The Google Drive link in the record is marked as broken and was not relied upon.
  • The EPSS date in the record (2026-10-23) is later than the publication date and should be verified against the source.
  • The record does not state whether non-cluster deployments are affected.

Frequently asked questions

What is CVE-2026-25769?

It is a critical deserialization of untrusted data vulnerability (CWE-502) in Wazuh cluster mode that, according to the record, can lead to remote code execution on the master node.

Which versions are affected?

The record describes the affected range as starting at 4.0.0 up to and including 4.14.2, and says version 4.14.3 fixes the issue.

Is this vulnerability being actively exploited?

The record shows it is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted. The SSVC value poc is not evidence of attacks in the wild.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.