CVEs / CVE-2025-24016
CVE-2025-24016: Wazuh Server Deserialization of Untrusted Data Vulnerability
- Known exploited in the CISA KEV catalog since 10 Jun 2025
- critical 9.9 CVSS 3.1 (from the CNA)
- EPSS 93.8% chance of exploitation in the next 30 days, higher than 99% of CVEs (30 Oct 2026)
- Last changed at its sources
Are you affected? Check your servers with Stackurity: it lists the software on each server and the vulnerabilities to fix first.
Check your servers with Stackurity Already using Stackurity? Search for CVE-2025-24016
Summary
Wazuh contains a deserialization of untrusted data vulnerability that allows for remote code execution on Wazuh servers.
Description
Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.4.0 and prior to version 4.9.1, an unsafe deserialization vulnerability allows for remote code execution on Wazuh servers. DistributedAPI parameters are a serialized as JSON and deserialized using `as_wazuh_object` (in `framework/wazuh/core/cluster/common.py`). If an attacker manages to inject an unsanitized dictionary in DAPI request/response, they can forge an unhandled exception (`__unhandled_exc__`) to evaluate arbitrary python code. The vulnerability can be triggered by anybody with API access (compromised dashboard or Wazuh servers in the cluster) or, in certain configurations, even by a compromised agent. Version 4.9.1 contains a fix.
Affected and fixed versions
| Product | Affected | Fixed in |
|---|---|---|
| wazuh wazuh | >= 4.4.0, < 4.9.1 | — |
| Product | Affected | Fixed in |
|---|---|---|
| github.com/wazuh/wazuh (Go) | from 4.4.0, before 4.9.1 | 4.9.1 |
Package versions from GHSA-hcrc-79hj-m3qh.
Exploitation
| In CISA KEV since | 10 Jun 2025 |
|---|---|
| Due date for US federal agencies | 1 Jul 2025 |
| Used in ransomware campaigns | Unknown |
| Required action | Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. |
Severity
| CVSS 3.1 | 9.9 criticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:HScored by the CNA ([email protected]) |
|---|---|
| Weakness | CWE-502 |
References
- CVE-2025-24016 on NVD
- CVE-2025-24016 in the CISA KEV catalog
- https://wazuh.com/blog/addressing-the-cve-2025-24016-vulnerability/ (cited by CISA)
- https://github.com/wazuh/wazuh/security/advisories/GHSA-hcrc-79hj-m3qh (cited by CISA)
- CVE-2025-24016 on OSV
- https://github.com/wazuh/wazuh/security/advisories/GHSA-hcrc-79hj-m3qh Exploit, Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24016 US Government Resource
Sources
Exploitation status from the CISA Known Exploited Vulnerabilities catalog. EPSS scores from FIRST. Descriptions, severity and references from the National Vulnerability Database. Open-source package versions from OSV (CC-BY 4.0). Text is shown as each source states it; Stackurity does not edit it. Check the vendor's advisory before acting.
This product uses data from the NVD API but is not endorsed or certified by the NVD.