9.9

CVE-2025-24016: Wazuh Server Deserialization of Untrusted Data Vulnerability

CVSS: 9.9v3.1CriticalKEVAnalyzed
AliasesGHSA-hcrc-79hj-m3qhGO-2025-3459
Published 10-02-2025Last modified 26-02-2026
Open JSON

Vulnerability summary

CVE-2025-24016 is a critical (CVSS 9.9) Deserialization of Untrusted Data vulnerability in Wazuh Wazuh Server. It is known to be exploited: CISA lists it, first on 10-06-2025. EPSS estimates a 93.84% chance of exploitation in the next 30 days, higher than 99.8% of scored vulnerabilities. 2 public exploits are recorded.

Overall risk
85/100
0100
Critical · default modelHow is this calculated?
CVSS score
9.9/10
010
Critical · v3.1 (CVE.org)
EPSS score
93.84%
0%100%
Critical · 0.00 pp in 30 days
KEVListedCISA
RansomwareNone recordedNo known use recorded
Public exploits2github, metasploit

Advisory lineage

Upstream 0 · Downstream 1 · Related 1
OPENSUSE-SU-2025:14889-1

Timeline

  1. 10-02-2025
    PublishedVulnerability first disclosed.
  2. 10-06-2025
    Added to CISA KEVWazuh Server Deserialization of Untrusted Data Vulnerability
  3. 01-07-2025
    CISA remediation dueApply mitigations per vendor instructions.
  4. 26-02-2026
    Last modifiedVulnerability information updated.

Description

Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.4.0 and prior to version 4.9.1, an unsafe deserialization vulnerability allows for remote code execution on Wazuh servers. DistributedAPI parameters are a serialized as JSON and deserialized using `as_wazuh_object` (in `framework/wazuh/core/cluster/common.py`). If an attacker manages to inject an unsanitized dictionary in DAPI request/response, they can forge an unhandled exception (`__unhandled_exc__`) to evaluate arbitrary python code. The vulnerability can be triggered by anybody with API access (compromised dashboard or Wazuh servers in the cluster) or, in certain configurations, even by a compromised agent. Version 4.9.1 contains a fix.

CVSS metrics

3 scores · 3 sources · 1 version

EPSS trend

Probability

93.84%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

0.00 pp

From 93.84% on 18-09-2026

18-09-202618-10-2026
EPSS score
93.84%

Known exploited

Compare KEV catalogs
CISA KEVListed
Added
10-06-2025
Federal due date
01-07-2025

CISA required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. wazuh.com/blog/addressing-the-cve-2025-24016-vulnerability/ github.com/wazuh/wazuh/security/advisories/GHSA-hcrc-79hj-m3qh nvd.nist.gov/vuln/detail/CVE-2025-24016

Public exploits

2 found
  • githubUnverified

    Wazuh

    Maturity: poc

  • MetasploitMetasploitremoteVerified

    Wazuh server remote code execution caused by an unsafe deserialization vulnerability.

    exploit/linux/http/wazuh_auth_rce_cve_2025_24016

    Maturity: weaponized

Weaknesses

CWE · root cause

Affected systems

Github.com/wazuh1 product
  • wazuh≥ 4.4.0, < 4.9.1 | ≥ 4.4.0+incompatible, < 4.9.1+incompatible
Wazuh1 product

2 vendors · 2 products

References

4 links