CVE-2026-25770
Wazuh is a free and open source platform used for threat prevention, detection, and response.
Published Mar 17, 2026 · updated Jun 17, 2026 · wazuh wazuh
Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 3.9.0 and prior to version 4.14.3, a privilege escalation vulnerability exists in the Wazuh Manager's cluster synchronization protocol. The service allows authenticated nodes to write arbitrary files to the manager’s file system with the permissions of the system user. Due to insecure default permissions, the user has write access to the manager's main configuration file ( ). By leveraging the cluster protocol to overwrite , an attacker can inject a malicious command block. The service, which runs as root, parses this configuration and executes the injected command. This chain allows an attacker with cluster credentials to gain full Root Remote Code Execution, violating the principle of least privilege and bypassing the intended security model. Version 4.14.3 fixes the issue.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Mar 17, 2026 · NIST NVD
Detected
Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 3.9.0 and prior to version 4.14.3, a privilege escalation vulnerability exists in the Wazuh Manager's cluster synchronization protocol. The service allows authenticated nodes to write arbitrary files to the manager’s file system with the permissions of the system user. Due to insecure
Jun 17, 2026 · NIST NVD
Updated
Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 3.9.0 and prior to version 4.14.3, a privilege escalation vulnerability exists in the Wazuh Manager's cluster synchronization protocol. The service allows authenticated nodes to write arbitrary files to the manager’s file system with the permissions of the system user. Due to insecure
Affected
- cpe wazuh/wazuhversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-25770
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-25770
Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 3.9.0 and prior to version 4.14.3, a privilege escalation vulnerability exists in the Wazuh Manager's cluster synchronization protocol. The service a
nvd.nist.gov