CVE-2025-24016
About
Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.4.0 and prior to version 4.9.1, an unsafe deserialization vulnerability allows for remote code execution on Wazuh servers. DistributedAPI parameters are a serialized as JSON and deserialized using `as_wazuh_object` (in `framework/wazuh/core/cluster/common.py`). If an attacker manages to inject an unsanitized dictionary in DAPI request/response, they can forge an unhandled exception (`__unhandled_exc__`) to evaluate arbitrary python code. The vulnerability can be triggered by anybody with API access (compromised dashboard or Wazuh servers in the cluster) or, in certain configurations, even by a compromised agent. Version 4.9.1 contains a fix.
Rainforest analyst review
Wazuh's server-side DistributedAPI serializes parameters as JSON and reconstructs them with the as_wazuh_object routine in the cluster common code. That deserialization is unsafe: by injecting a crafted dictionary into a DAPI request or response, an attacker can forge an unhandled-exception object whose contents are passed to a Python eval, executing arbitrary Python code on the Wazuh server. Any party with API access can trigger it, and in certain configurations even a compromised agent can reach the vulnerable path.
Wazuh is a widely deployed open-source security platform for threat detection and response, so its server is a trusted central node that ingests telemetry from every monitored endpoint and holds broad visibility and often credentials. Turning the security monitoring system itself into an RCE target is a serious inversion of trust, and public proof-of-concept code exists, with the bug drawing botnet interest against exposed clusters. Upgrade to Wazuh 4.9.1 or later, restrict API and cluster ports to trusted hosts, and where agents could reach the DAPI path, review the deployment's trust boundaries so a single compromised agent cannot pivot into code execution on the manager.
References
Related CVEs
Frequently asked questions
What is CVE-2025-24016?
Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.4.0 and prior to version 4.9.1, an unsafe deserialization vulnerability allows for remote code execution on Wazuh servers. DistributedAPI parameters are a serialized as JSON and deserialized using `as_wazuh_object` (in `framework/wazuh/core/cluster/common.py`).
How severe is CVE-2025-24016?
CVE-2025-24016 carries a CVSS 3.1 base score of 9.9, rated critical. On the Rainforest Risk Index — which weighs the severity alongside how easy the flaw is to reach and how broad its impact is — it scores 97 out of 100, in the critical band.
How is CVE-2025-24016 exploited?
According to the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H): attack vector Network, attack complexity Low, privileges required Low, user interaction None. Impact on confidentiality Low, integrity High and availability High.
Which products are affected by CVE-2025-24016?
Public advisories list the following as affected: wazuh. Check the references on this page for the exact versions each vendor confirms.
How do I fix CVE-2025-24016?
Apply the fix the vendor published — the references on this page link to the primary advisories and patches. When patching can't happen right away, reduce the exposure of the affected component and watch it for exploitation attempts. Rainforest customers see this vulnerability correlated to their own assets and prioritized by real exposure, not by score alone.
Empower Your Security Strategy with Rainforest
Discover vulnerabilities early, prioritize critical threats, and protect what truly matters. Rainforest streamlines your security operations, saving you time and reducing costs, so you can focus on what drives your business forward.