Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.4.0 and prior to version 4.9.1, an unsafe deserialization vulnerability allows for remote code execution on Wazuh servers. DistributedAPI parameters are a serialized as JSON and deserialized using `as_wazuh_object` (in `framework/wazuh/core/cluster/common.py`). If an attacker manages to inject an unsanitized dictionary in DAPI request/response, they can forge an unhandled exception (`__unhandled_exc__`) to evaluate arbitrary python code. The vulnerability can be triggered by anybody with API access (compromised dashboard or Wazuh servers in the cluster) or, in certain configurations, even by a compromised agent. Version 4.9.1 contains a fix.

According to the self-reported version in its response header, the version of Wazuh hosted on the remote web server is 4.4.x prior to 4.9.1. It is, therefore, affected by a Remote Code Execution through an unsafe deserialization by anybody with API access.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in
    version 4.4.0 and prior to version 4.9.1, an unsafe deserialization vulnerability allows for remote code
    execution on Wazuh servers. DistributedAPI parameters are a serialized as JSON and deserialized using
    `as_wazuh_object` (in `framework/wazuh/core/cluster/common.py`). If an attacker manages to inject an
    unsanitized dictionary in DAPI request/response, they can forge an unhandled exception
    (`__unhandled_exc__`) to evaluate arbitrary python code. The vulnerability can be triggered by anybody
    with API access (compromised dashboard or Wazuh servers in the cluster) or, in certain configurations,
    even by a compromised agent. Version 4.9.1 contains a fix. (CVE-2025-24016)

The version of Wazuh Server on the remote host is at least 4.4.0 and prior to 4.9.1. It is, therefore, affected by a remote code execution vulnerability:

  - Starting in version 4.4.0 and prior to version 4.9.1, an unsafe deserialization vulnerability allows for     remote code execution on Wazuh servers. DistributedAPI parameters are a serialized as JSON and     deserialized using `as_wazuh_object` (in `framework/wazuh/core/cluster/common.py`). If an attacker manages     to inject an unsanitized dictionary in DAPI request/response, they can forge an unhandled exception     (`__unhandled_exc__`) to evaluate arbitrary python code. The vulnerability can be triggered by anybody     with API access (compromised dashboard or Wazuh servers in the cluster) or, in certain configurations,     even by a compromised agent. Version 4.9.1 contains a fix. (CVE-2025-24016)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
115042	Wazuh 4.4x < 4.9.1 Remote Code Execution	Web App Scanning	Component Vulnerability	Version Based	critical
434643	SCA: security update for github.com/wazuh/wazuh (GHSA-hcrc-79hj-m3qh)	Tenable Cloud Security	SCA Checks	Local	critical
434643	SCA: security update for github.com/wazuh/wazuh (GHSA-hcrc-79hj-m3qh)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical
235712	Wazuh Server 4.4.0 < 4.9.1 RCE	Nessus	Misc.	Local	critical

Detections

Analytics

CVE-2025-24016

critical

Tenable Plugins

critical

critical

critical

critical