CVE-2025-24016

CVE Enrichment

CVSS: 9.9 CRITICAL
EPSS: 93.84%
EPSS Percentile: 99.85%
CISA KEV: YES — Known Exploited Vulnerability

Description

Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.4.0 and prior to version 4.9.1, an unsafe deserialization vulnerability allows for remote code execution on Wazuh servers. DistributedAPI parameters are a serialized as JSON and deserialized using `as_wazuh_object` (in `framework/wazuh/core/cluster/common.py`). If an attacker manages to inject an unsanitized dictionary in DAPI request/response, they can forge an unhandled exception (`__unhandled_exc__`) to evaluate arbitrary python code. The vulnerability can be triggered by anybody with API access (compromised dashboard or Wazuh servers in the cluster) or, in certain configurations, even by a compromised agent. Version 4.9.1 contains a fix.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: security-advisories@github.com
Published: 11-Feb-2025 03:15
Last Modified: 17-Jun-2026 15:57
EPSS Date: 2026-10-20
CWE: CWE-502

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:L /
                            UI:N /
                            S:C /
                            C:L /
                            I:H /
                            A:H

CISA KEV Details

Date Added: 2025-06-10
Remediation Due: 2025-07-01
Known Ransomware Campaign Use: Unknown
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Notes: https://wazuh.com/blog/addressing-the-cve-2025-24016-vulnerability/ ; https://github.com/wazuh/wazuh/security/advisories/GHSA-hcrc-79hj-m3qh ; https://nvd.nist.gov/vuln/detail/CVE-2025-24016

Affected Products / Versions

wazuh / wazuh
Version / affected range: * · from (inclusive) 4.4.0 · before (exclusive) 4.9.1
cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*

References

Last enrichment sync: 21-Oct-2026 04:49
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

In 2025, attackers exploited an unsafe deserialization vulnerability in Wazuh Manager (CVE-2025-24016), enabling remote code execution. Darktrace 2026 Threat Report Highlights Identity Abuse, Phishing and Data Extortion

CVE (12)

Malware (10)

Threat Actors (9)

MITRE ATT&CK (15)

Vendors (6)

Products (10)

Tools (10)

Industries (10)

Countries (10)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.