🚨 CVE-2026-25769 - Wazuh Insecure Deserialization RCE

Critical Worker ➜ Master Remote Code Execution in Wazuh Cluster Mode

Unsafe deserialization in Wazuh cluster communications allows a compromised worker node to achieve root RCE on the master node.

📌 Overview

CVE ID: CVE-2026-25769 Product: Wazuh Affected Versions: 4.0.0 → 4.14.2 Fixed Version: 4.14.3 Severity: Critical CVSS v3.1: 9.1 CWE: CWE-502 — Deserialization of Untrusted Data

A critical vulnerability in Wazuh cluster mode allows an attacker with access to a worker node to send malicious serialized payloads that are processed by the master node, resulting in remote code execution with root privileges. (nvd.nist.gov)

🧠 Technical Summary

The vulnerability exists in the master/worker synchronization workflow.

When a worker node exchanges cluster data with the master, untrusted serialized objects may be deserialized without sufficient validation.

This enables a threat actor who already controls a worker to:

• inject malicious serialized payloads
• trigger arbitrary Python object reconstruction
• execute attacker-controlled code
• pivot into the master manager
• gain root-level execution

🔥 Attack Path

Initial Access → Worker Node Compromise
                ↓
Malicious Cluster Sync Payload
                ↓
Unsafe Deserialization on Master
                ↓
Root Remote Code Execution
                ↓
Full SOC / SIEM Infrastructure Compromise

📷 Screenshot

🎯 Affected Scope

This CVE affects environments where:

• ✅ Wazuh is running in cluster mode
• ✅ version is between 4.0.0 and 4.14.2
• ✅ at least one worker node is compromised
• ✅ worker ↔ master communication is allowed

⚠️ High-Risk Targets

Because the master node centralizes:

• detection rules
• agent keys
• integrations
• active responses
• cloud connectors
• threat intelligence feeds
• SOC dashboards

A successful exploit may lead to complete SIEM takeover. (nvd.nist.gov)

🛡️ Mitigation

✅ Permanent Fix

Upgrade immediately:

Wazuh >= 4.14.3

The vendor confirms 4.14.3 patches the vulnerability. (nvd.nist.gov)

🚑 Temporary Hardening

Until patching is complete:

# Restrict cluster traffic
Allow only trusted worker IPs
Disable unused workers
Rotate cluster authentication secrets
Limit east-west lateral movement
Monitor cluster sync anomalies

Additional recommendations:

• isolate worker nodes into separate VLANs
• restrict SSH access
• rotate API keys
• verify custom integrations
• audit /var/ossec/logs/
• review root-owned file changes

🔍 Detection & Threat Hunting

📁 Log Artifacts

Focus on:

/var/ossec/logs/ossec.log
/var/ossec/queue/cluster/
/var/ossec/framework/python/

🧪 Hunting Indicators

- unusual worker sync bursts
- malformed serialized payload errors
- unexpected Python child processes
- shell execution from wazuh-manager
- new root-owned temp files
- worker-originated privilege escalation chain

🧩 Sigma-style Detection Logic

title: Wazuh Cluster Unsafe Deserialization Attempt
id: CVE-2026-25769
status: experimental
logsource:
  product: linux
  service: wazuh-manager

detection:
  selection:
    process.parent.name: wazuh-manager
    process.name:
      - python3
      - sh
      - bash
  condition: selection

level: critical

📊 CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

📖 Meaning

• AV:N → exploitable over network
• AC:L → low complexity
• PR:H → requires worker compromise first
• S:C → scope changes worker ➜ master
• CIA:H → total confidentiality, integrity, availability impact

🧱 Executive Risk Statement

A single compromised worker can become a launchpad to fully compromise the Wazuh master, effectively giving an attacker control over the organization’s centralized detection and response stack.

This is especially dangerous for:

• MSSPs
• enterprise SOCs
• multi-tenant Wazuh clusters
• cloud SIEM deployments
• regulated environments

📚 References

• NVD Advisory — CVE-2026-25769 (nvd.nist.gov)
• Wazuh Vendor Advisory (GHSA) (github.com)
• Wazuh Releases / Patched Version (github.com)