ZeroDay Findings
Sign inSign up

Findings

Vulnerability · CVE-2025-24016

Wazuh Server Deserialization of Untrusted Data Vulnerability

Published Feb 10, 2025 · corrected/updated Jun 17, 2026 · Wazuh Wazuh Server · evidence confidence very high

Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.4.0 and prior to version 4.9.1, an unsafe deserialization vulnerability allows for remote code execution on Wazuh servers. DistributedAPI parameters are a serialized as JSON and deserialized using (in ). If an attacker manages to inject an unsanitized dictionary in DAPI request/response, they can forge an unhandled exception ( ) to evaluate arbitrary python code. The vulnerability can be triggered by anybody with API access (compromised dashboard or Wazuh servers in the cluster) or, in certain configurations, even by a compromised agent. Version 4.9.1 contains a fix.

Grounded briefings

Catalog interpretations for three audiences. Each brief cites ingested metadata and the original advisories below. They are not independent research and they do not invent exploit steps.

Executive

CVE-2025-24016 is a critical public vulnerability record for Wazuh Wazuh Server. CISA lists it as known exploited. Published remediation guidance: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. This summary is a catalog interpretation of the ingested metadata and cites the original advisories below.

System administrator

Identify whether Wazuh Wazuh Server is in your estate, then compare installed versions with the affected ranges. Affected packages or ranges on record: wazuh/wazuh; Wazuh Wazuh Server. Published remediation guidance: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Prefer the vendor or distribution advisory linked in Sources before changing production systems. This is a catalog interpretation, not a runbook.

Security analyst

Signals on file: CVSS 9.9, EPSS 93.8%. CISA lists it as known exploited. Weakness classes: CWE-502. Sources contributing to this record: cisa_kev, cve_org, epss, metasploit. Public exploit references, when present, are outbound links only and are not proof of active exploitation. This is a catalog interpretation of stored metadata.

Exploitation and remediation

  • Exploitation evidence

    Confirmed in CISA KEV since May 3, 2025. Listed in CISA KEV and VulnCheck KEV.

  • Patch and remediation

    Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. CISA due date Jul 1, 2025.

  • Safe detection guidance

    Compare installed versions with the affected ranges below and verify the advisory from the original publisher. This site stores metadata and outbound links only; it does not ship exploit code or proof-of-concept payloads.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Feb 10, 2025 · Catalog

    Detected

    Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.4.0 and prior to version 4.9.1, an unsafe deserialization vulnerability allows for remote code execution on Wazuh servers. DistributedAPI parameters are a serialized as JSON and deserialized using (in ). If an attacker manages to inject an unsanitized dictionary in DAPI request/respo

  2. Jun 10, 2025 · CISA KEV

    Known exploited

    Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

  3. Jul 1, 2025 · CISA KEV

    Remediation due

    Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

  4. Jun 17, 2026 · Catalog

    Updated

    Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.4.0 and prior to version 4.9.1, an unsafe deserialization vulnerability allows for remote code execution on Wazuh servers. DistributedAPI parameters are a serialized as JSON and deserialized using (in ). If an attacker manages to inject an unsanitized dictionary in DAPI request/respo

Affected

  • cpe wazuh/wazuhversion unspecified
  • vendor Wazuh Wazuh Serverversion unspecified

Sources

  • CISA KEVConfirmed exploitationCVE-2025-24016

    Wazuh contains a deserialization of untrusted data vulnerability that allows for remote code execution on Wazuh servers.

    cisa.gov
  • CVE.orgVulnerability recordCVE-2025-24016

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2025-24016

    30-day exploitation probability 93.8%

    first.org
  • Metasploit ModulesPublic exploit moduleexploit_linux/http/wazuh_auth_rce_cve_2025_24016

    Public module reference (excellent). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDVulnerability recordCVE-2025-24016

    Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.4.0 and prior to version 4.9.1, an unsafe deserialization vulnerability allows for remote code execution on Wazuh servers. DistributedAPI parameters are a serialize

    nvd.nist.gov
  • VulnCheck KEVConfirmed exploitationCVE-2025-24016

    Wazuh contains a deserialization of untrusted data vulnerability that allows for remote code execution on Wazuh servers.

    vulncheck.com

References