CVE-2025-24016: Wazuh server unsafe deserialization allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.9, CISA KEV listing, very high EPSS probability and a vendor advisory tagged Exploit make this an actively targeted remote code execution flaw.

What it is

Wazuh versions 4.4.0 through 4.9.0 deserialize DistributedAPI parameters with an unsafe helper (as_wazuh_object), letting an attacker who can inject an unsanitized dictionary into a DAPI request or response forge an unhandled exception and evaluate arbitrary Python code. Because Wazuh is a security monitoring platform, compromise of its server undermines the visibility and response capability it provides. Version 4.9.1 contains the fix.

Impact

An attacker gains remote code execution on the Wazuh server, which can lead to full control of the monitoring infrastructure and the data and credentials it holds. The CVSS vector indicates high integrity and availability impact with scope change.

Attack surface

Reached over the network through the Wazuh API or cluster communication; the vector requires low privileges (PR:L) and no user interaction. The description states anyone with API access can trigger it, and in certain configurations a compromised agent can as well.

Exploitation

CVE-2025-24016 is listed in CISA KEV with a due date of 2025-07-01, and EPSS gives a 30-day probability of 0.9384 (99.84th percentile). The vendor advisory reference is tagged Exploit, indicating public exploit material exists.

What to do

• Upgrade Wazuh to version 4.9.1 or later, which contains the fix.
• If immediate upgrade is not possible, restrict network access to the Wazuh API and cluster ports to trusted hosts only.
• Rotate credentials and API keys for Wazuh servers and dashboards, and review for signs of prior compromise.
• Limit or disable agent enrollment and communication paths that could allow a compromised agent to reach DAPI, per vendor guidance.
• Follow CISA KEV required actions and BOD 22-01 guidance for cloud-hosted instances.

Detection

• Monitor Wazuh server and API logs for unexpected exceptions or references to __unhandled_exc__ in DAPI request or response handling.
• Alert on unusual child processes or Python execution spawned by the Wazuh server or cluster daemons.
• Review API access logs for anomalous or unexpected clients, especially from agent or dashboard sources.
• Hunt for outbound network connections from Wazuh servers to unfamiliar destinations that could indicate post-exploitation activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.