{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/wazuh-manager-4.4.0-through-4.9.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.9,"id":"CVE-2025-24016"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Wazuh Manager (4.4.0 through 4.9.0)"],"_cs_severities":["critical"],"_cs_tags":["vulnerability","rce","wazuh","insecure-deserialization"],"_cs_type":"advisory","_cs_vendors":["Wazuh"],"content_html":"\u003cp\u003eCVE-2025-24016 is a critical remote code execution vulnerability affecting Wazuh Manager versions 4.4.0 through 4.9.0. The vulnerability exists within the DistributedAPI, where input parameters are serialized as JSON and processed using an insecure deserialization method in \u003ccode\u003eframework/wazuh/core/cluster/common.py\u003c/code\u003e. Attackers with API access can exploit this by injecting a crafted, unsanitized dictionary - specifically targeting the \u003ccode\u003e__unhandled_exc__\u003c/code\u003e parameter - into the \u003ccode\u003e/security/user/authenticate/run_as\u003c/code\u003e endpoint to achieve arbitrary Python code execution.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for arbitrary code execution on the master Wazuh server with the privileges of the Wazuh service. The vulnerability can also be leveraged to trigger a denial of service (server shutdown) via unauthorized execution of the \u003ccode\u003eexit\u003c/code\u003e function.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eUpgrade all instances of Wazuh Manager to version 4.9.1 or later immediately. Access to the Wazuh API should be restricted to trusted sources and protected by robust authentication and network-level access controls to mitigate exploitation attempts by unauthorized parties.\u003c/p\u003e\n","date_modified":"2026-10-25T17:47:02Z","date_published":"2026-10-25T17:47:02Z","id":"https://feed.craftedsignal.io/briefs/2026-10-wazuh-rce-cve-2025-24016/","summary":"Wazuh Manager versions 4.4.0 through 4.9.0 are vulnerable to remote code execution due to insecure deserialization in the DistributedAPI component.","title":"Wazuh Manager: Remote code execution via insecure deserialization (CVE-2025-24016)","url":"https://feed.craftedsignal.io/briefs/2026-10-wazuh-rce-cve-2025-24016/"}],"language":"en","title":"CraftedSignal Threat Feed - Wazuh Manager (4.4.0 Through 4.9.0)","version":"https://jsonfeed.org/version/1.1"}