CVE-2026-48024 wazuh CVE debrief

Who should care

Wazuh users and administrators, security teams, and IT professionals responsible for threat prevention, detection, and response should review their deployments and plan for an upgrade to a secure version. Additionally, vulnerability management teams and security operations centers (SOCs) should be aware of the potential impact and prioritize patching or mitigation efforts accordingly. Affected operators should verify their Wazuh versions and plan for an upgrade to a secure version. Platform administrators should review their Wazuh configurations and ensure that they are not exposed to untrusted peers. Vulnerability management teams should prioritize patching or mitigation efforts for affected deployments. Security teams should monitor Wazuh logs for suspicious activity and implement additional security controls to detect and prevent potential exploitation. IT professionals responsible for threat prevention, detection, and response should review their incident response plans and be prepared to respond to potential exploitation attempts. Security operations centers (SOCs) should be aware of the potential impact and prioritize monitoring and detection efforts for affected deployments. Asset owners should verify their Wazuh deployments and plan for an upgrade to a secure version. Compliance teams should review their vulnerability management policies and ensure that affected deployments are prioritized for patching or mitigation. Incident response teams should review their incident response plans and be prepared to respond to potential exploitation attempts. Business stakeholders should be aware of the potential impact and prioritize patching or mitigation efforts for affected deployments. Security awareness and training teams should educate users about the potential risks and ensure that they are aware of the importance of patching or mitigation efforts. Public sector organizations should prioritize patching or mitigation efforts for affected deployments and ensure that they are in compliance with relevant regulations and standards. Managed security service providers (MSSPs) should prioritize patching or mitigation efforts for affected deployments and ensure that他们的

Technical summary

The vulnerability exists in the cluster.unmerge_info() function in framework/wazuh/core/cluster/cluster.py and process_files_from_worker() in framework/wazuh/core/cluster/master.py. An attacker can use traversal in files_metadata.json or a merged-file header to write arbitrary files, potentially leading to code execution when Wazuh services reload. The vulnerability has a critical CVSS score of 9.1 and is fixed in versions 4.14.6 and 5.0.0-beta3.

Defensive priority

High priority due to critical CVSS score of 9.1 and potential for code execution.

Recommended defensive actions

• Immediately upgrade to Wazuh version 4.14.6 or 5.0.0-beta3 or later
• Restrict access to the Wazuh cluster to trusted peers only
• Monitor Wazuh logs for suspicious activity
• Implement additional security controls to detect and prevent potential exploitation
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

Evidence from official CVE and NVD sources indicate a critical vulnerability in Wazuh, a free and open-source platform for threat prevention, detection, and response. The vulnerability exists in versions 4.0.0 to 4.14.6 and 5.0.0-beta3, where an attacker can use traversal in files_metadata.json or a merged-file header to write arbitrary files, potentially leading to code execution.

Official resources