CVE-2026-61800 wazuh CVE debrief

Who should care

Defenders responsible for Wazuh deployments, particularly those using versions 4.4.0 through 4.14.6, should assess exposure and prioritize upgrading to version 4.14.7 or later. They should also restrict cluster key access to prevent exploitation and monitor /var/ossec for suspicious file modifications. Security teams should review current Wazuh versions, assess cluster key management, and verify the integrity of /var/ossec files.

Why it matters

CVE-2026-61800 is a critical vulnerability in Wazuh that allows remote code execution as root. Defenders should prioritize upgrading to version 4.14.7 or later and restrict cluster key access to prevent exploitation.

• Remote code execution as root on worker nodes
• Potential for overwriting or deleting critical files under /var/ossec
• Need for verification of current Wazuh version and cluster key management
• Potential impact on endpoint and cloud workload security

Technical summary

The vulnerability in Wazuh allows a party holding the cluster key to write, overwrite, or delete arbitrary files under /var/ossec on worker nodes, leading to remote code execution as root. This issue affects versions 4.4.0 through 4.14.6 and is addressed in version 4.14.7. The vulnerability is an incomplete fix for CVE-2026-30893, which addressed traversal outside /var/ossec but left this path able to redirect files anywhere within it. Defenders should prioritize upgrading to version 4.14.7 or later and restrict cluster key access to prevent remote code execution.

Defensive priority

Defenders should prioritize upgrading to version 4.14.7 or later and restrict cluster key access to prevent remote code execution.

Recommended defensive actions

• Upgrade to Wazuh version 4.14.7 or later
• Restrict access to the cluster key
• Monitor /var/ossec for suspicious file modifications
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and the affected versions. However, additional information on exploitation or victim organizations is not available. Defenders should verify current Wazuh versions, assess cluster key management, and monitor /var/ossec for suspicious file modifications. The vulnerability affects Wazuh versions 4.4.0 through 4.14.6, and defenders should prioritize upgrading to version 4.14.7 or later.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.