Impact

Successful exploitation allows for arbitrary code execution on the master Wazuh server with the privileges of the Wazuh service. The vulnerability can also be leveraged to trigger a denial of service (server shutdown) via unauthorized execution of the exit function.

Recommendation

Upgrade all instances of Wazuh Manager to version 4.9.1 or later immediately. Access to the Wazuh API should be restricted to trusted sources and protected by robust authentication and network-level access controls to mitigate exploitation attempts by unauthorized parties.