Wazuh Manager: Remote code execution via insecure deserialization (CVE-2025-24016)

CVE-2025-24016 is a critical remote code execution vulnerability affecting Wazuh Manager versions 4.4.0 through 4.9.0. The vulnerability exists within the DistributedAPI, where input parameters are serialized as JSON and processed using an insecure deserialization method in framework/wazuh/core/cluster/common.py. Attackers with API access can exploit this by injecting a crafted, unsanitized dictionary - specifically targeting the __unhandled_exc__ parameter - into the /security/user/authenticate/run_as endpoint to achieve arbitrary Python code execution.

Impact

Successful exploitation allows for arbitrary code execution on the master Wazuh server with the privileges of the Wazuh service. The vulnerability can also be leveraged to trigger a denial of service (server shutdown) via unauthorized execution of the exit function.

Recommendation

Upgrade all instances of Wazuh Manager to version 4.9.1 or later immediately. Access to the Wazuh API should be restricted to trusted sources and protected by robust authentication and network-level access controls to mitigate exploitation attempts by unauthorized parties.