CVE Explorer
CVE-2026-25769
Wazuh is a free and open source platform used for threat prevention, detection, and response. Versions 4.0.0 through 4.14.2 have a Remote Code Execution (RCE) vulnerability due to Deserialization of Untrusted Data). All Wazuh deployments using cluster mode (master/worker architecture) and any organization with a compromised worker node (e.g., through initial access, insider threat, or supply chain attack) are impacted. An attacker who gains access to a worker node (through any means) can achieve
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"product":"wazuh","vendor":"wazuh","versions":[{"status":"affected","version":">= 4.0.0, < 4.14.3"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:95f9b0f06c3361fb10ab7de1ce0e8c4a5acd63436734cd099a994f46b853b179 · sha256:3906b74aed8c97b3… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:95f9b0f06c3361fb10ab7de1ce0e8c4a5acd63436734cd099a994f46b853b179 · sha256:3906b74aed8c97b3… · /containers/cna/metrics/0/cvssV3_1
CWE assertions
1 source assertion{"cweId":"CWE-502","description":"CWE-502: Deserialization of Untrusted Data","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:95f9b0f06c3361fb10ab7de1ce0e8c4a5acd63436734cd099a994f46b853b179 · sha256:3906b74aed8c97b3… · /containers/cna/problemTypes/0/descriptions/0
Source references
3 source assertions{"name":"https://drive.google.com/drive/folders/1WlkKNmHexz8212OVED9O6M_3pI8b6qNI?usp=sharing","tags":["x_refsource_MISC"],"url":"https://drive.google.com/drive/folders/1WlkKNmHexz8212OVED9O6M_3pI8b6qNI?usp=sharing"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:95f9b0f06c3361fb10ab7de1ce0e8c4a5acd63436734cd099a994f46b853b179 · sha256:3906b74aed8c97b3… · /containers/cna/references/1
{"name":"https://github.com/wazuh/wazuh/security/advisories/GHSA-3gm7-962f-fxw5","tags":["x_refsource_CONFIRM"],"url":"https://github.com/wazuh/wazuh/security/advisories/GHSA-3gm7-962f-fxw5"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:95f9b0f06c3361fb10ab7de1ce0e8c4a5acd63436734cd099a994f46b853b179 · sha256:3906b74aed8c97b3… · /containers/cna/references/0
{"tags":["exploit"],"url":"https://github.com/wazuh/wazuh/security/advisories/GHSA-3gm7-962f-fxw5"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:95f9b0f06c3361fb10ab7de1ce0e8c4a5acd63436734cd099a994f46b853b179 · sha256:3906b74aed8c97b3… · /containers/adp/0/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.