CVE-2026-54083 wazuh CVE debrief

Who should care

Security teams responsible for endpoint and cloud workload security should assess their exposure to this vulnerability and prioritize patching Wazuh installations to version 4.14.7 or later.

Why it matters

Defenders should prioritize patching Wazuh installations to version 4.14.7 or later to mitigate the path traversal vulnerability in the ip-customblock active response script. Security teams responsible for endpoint and cloud workload security should assess their exposure and apply the fix as soon as possible to prevent potential arbitrary file creation or deletion as root.

• Potential for arbitrary file creation or deletion as root
• Exposure of sensitive files such as system credentials and Wazuh configuration
• Possible disruption of endpoint and cloud workload security
• Need for verification of affected versions and remediation status

Technical summary

The ip-customblock active response script in Wazuh contains a path traversal vulnerability. The script concatenates the srcip field from alert JSON directly onto a fixed base directory without validating if the value is a well-formed IP address. This allows an attacker to create or delete arbitrary files on the filesystem as root by triggering log events with a crafted srcip containing ../ sequences.

Defensive priority

Defenders should prioritize patching Wazuh installations to version 4.14.7 or later to mitigate this vulnerability. Specifically, security teams responsible for endpoint and cloud workload security should assess their exposure and apply the fix as soon as possible.

Recommended defensive actions

• Patch Wazuh installations to version 4.14.7 or later
• Assess exposure and apply the fix as soon as possible
• Review and update security configurations for endpoint and cloud workload protection
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD vulnerability detail provide information on the path traversal vulnerability in the ip-customblock active response script of Wazuh. The official CVE Program record and NIST NVD detail page offer source-provided CVE metadata and vulnerability assessment.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.