Wazuh Server Remote Code Execution (RCE) Vulnerability Advisory (CVE-2025-24016)
Executive & SecOps Summary
SECOPS ASSESSMENTWazuh server and cluster environments running versions 4.4.0 through 4.9.0
Attackers with API access or compromised agents can execute arbitrary Python code on the Wazuh server by manipulating Distributed API (DAPI) parameters, leading to full system compromise
Immediately upgrade Wazuh manager and cluster nodes to the patched version (v4.9.1 or higher) and restrict API access
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
To remediate this vulnerability, upgrade all Wazuh managers and cluster nodes to version 4.9.1 or later. Use the following package manager commands depending on your operating system:
# For Debian/Ubuntu-based Wazuh Managers
sudo apt-get update
sudo apt-get --only-upgrade install wazuh-manager -y
sudo systemctl restart wazuh-manager# For RedHat/CentOS/AL2-based Wazuh Managers
sudo yum clean all
sudo yum update wazuh-manager -y
sudo systemctl restart wazuh-manager2. Temporary Workaround & Hardening Configuration
If an immediate upgrade is not feasible, restrict access to the Wazuh API port (default: 55000) and cluster communication port (default: 1516) using firewall rules to ensure only trusted IPs can communicate with these services.
# Restrict Wazuh API (55000) and Cluster (1516) ports using iptables
# Replace 192.168.1.100 with your trusted administrator IP
sudo iptables -A INPUT -p tcp -s 192.168.1.100 --dport 55000 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 55000 -j DROP
sudo iptables -A INPUT -p tcp -s 192.168.1.0/24 --dport 1516 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 1516 -j DROP3. Log Audit & IoC Verification Commands
Verify the currently running Wazuh version and inspect the API and system logs for any indicators of compromise (IoCs) related to deserialization exploits.
# Check the installed Wazuh Manager version
/var/ossec/bin/wazuh-control info
# Scan logs for suspicious unhandled exception payloads
grep -ri '__unhandled_exc__' /var/ossec/logs/api.log /var/ossec/logs/ossec.logDetect Container Escape & Privilege Escalation Across Your Kubernetes Fleet
Continuous eBPF-based runtime threat detection and posture management for AWS, GCP, Azure, Docker, and Kubernetes workloads.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2025-24016) is an unsafe deserialization flaw (CWE-502) in the Distributed API (DAPI) parameter handling mechanism of Wazuh, a free and open-source security monitoring platform. In affected versions, DAPI parameters are serialized as JSON and subsequently deserialized using the as_wazuh_object function within framework/wazuh/core/cluster/common.py. Due to insufficient sanitization of input dictionaries during this process, the deserializer can be manipulated into evaluating arbitrary objects.
2. Exploitation Mechanics & Attack Scenario
An attacker with valid API access (such as a compromised dashboard account or an authorized cluster node) can inject a malicious, unsanitized dictionary into a DAPI request or response. By forging an unhandled exception object (__unhandled_exc__), the attacker forces the deserialization engine to evaluate arbitrary Python code embedded within the payload. In specific network topologies, even a compromised agent can trigger this vulnerability, allowing for lateral movement from an endpoint to the central security management server.
3. Infrastructure & Business Impact
Given that Wazuh serves as the central nervous system for security monitoring, intrusion detection, and compliance, an RCE vulnerability on the Wazuh server carries extreme risk (CVSS 9.9). This vulnerability is actively exploited in the wild and is listed on the CISA KEV catalog. Successful exploitation allows attackers to disable security monitoring, manipulate audit logs, steal sensitive credentials, and pivot to other critical infrastructure components managed by the Wazuh agents.
Official Vendor Advisories & References
Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.4.0 and prior to version 4.9.1, an unsafe deserialization vulnerability allows for remote code execution on Wazuh servers. DistributedAPI parameters are a serialized as JSON and deserialized using `as_wazuh_object` (in `framework/wazuh/core/cluster/common.py`). If an attacker manages to inject an unsanitized dictionary in DAPI request/response, they can forge an unhandled exception (`__unhandled_exc__`) to evaluate arbitrary python code. The vulnerability can be triggered by anybody with API access (compromised dashboard or Wazuh servers in the cluster) or, in certain configurations, even by a compromised agent. Version 4.9.1 contains a fix.
Frequently Asked SecOps Questions (CVE-2025-24016)
FAQQ1. How critical is CVE-2025-24016 and is it actively exploited in the wild?
CVE-2025-24016 is rated CVSS 9.9 (CRITICAL) with a 30-day EPSS exploitation probability of 93.8%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2025-24016?
Primary impacted vendors include wazuh across wazuh-manager, wazuh-api. Scope summary: Wazuh versions 4.4.0 up to (but not including) 4.9.1
Q3. What temporary mitigations or workarounds exist for CVE-2025-24016 before patching?
[Mitigation] Immediately upgrade Wazuh manager and cluster nodes to the patched version (v4.9.1 or higher) and restrict API access Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2025-24016
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (wazuh)
View Category →Kestra Orchestration Platform Authentication Bypass and Remote Code Execution (RCE) Vulnerability (CVE-2026-49869)
[Affected Scope] Kestra open-source versions prior to 1.0.45 and 1.3.21
MLflow Webhook Test Endpoint Server-Side Request Forgery (SSRF) Vulnerability (CVE-2026-64849)
[Affected Scope] MLflow versions from 3.3.0 prior to 3.15.0
VMware ESX Insufficient Logging Vulnerability (CVE-2026-41709) - Audit Bypass and Admin Activity Concealment
[Affected Scope] VMware ESX hypervisor environments.
Cisco Secure Firewall Management Center (FMC) Insecure Deserialization Vulnerability (CVE-2026-20131, CVSS 10.0) - Remote Code Execution and Root Privilege Escalation
[Affected Scope] Web-based management interface of Cisco Secure Firewall Management Center (FMC) Software.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.