CVE-2026-61800 wazuh CVE debrief

Who should care

System administrators and security teams responsible for Wazuh installations, particularly those using versions 4.4.0 through 4.14.6, should assess their exposure and prioritize upgrading to version 4.14.7 or later.

Why it matters

CVE-2026-61800 is a critical vulnerability in Wazuh that allows remote code execution as root on worker nodes. System administrators and security teams should assess their exposure, particularly if using versions 4.4.0 through 4.14.6, and prioritize upgrading to version 4.14.7 or later.

• Remote code execution as root on worker nodes
• Arbitrary file modification under /var/ossec
• Potential for lateral movement within the cluster

Technical summary

The vulnerability in Wazuh allows a party holding the cluster key to write, overwrite, or delete arbitrary files under /var/ossec on worker nodes, leading to remote code execution as root. This is due to improper file synchronization during cluster updates, specifically in the update_master_files_in_worker() function. The issue is an incomplete fix for CVE-2026-30893 and has been addressed in version 4.14.7. Affected versions include 4.4.0 through 4.14.6. The vulnerability stems from the non-merged branch of update_master_files_in_worker() moving each staged file to a destination derived only from safe_join(), which confines the path to /var/ossec but never verifies that the file lands in the directory declared

Defensive priority

High

Recommended defensive actions

• Upgrade to Wazuh version 4.14.7 or later
• Restrict access to the cluster key
• Monitor /var/ossec for suspicious file modifications
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and the affected versions. The vendor, Wazuh, has released a patch in version 4.14.7. Evidence from the CVE Program and NVD confirms the vulnerability's existence and impact. Affected versions include 4.4.0 through 4.14.6. Defenders should verify their deployments and plan for upgrades or mitigations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.