Privilege Escalation Vulnerability in Wazuh Manager by Wazuh

CVE-2026-25770

What is CVE-2026-25770?

Wazuh is a widely used open-source platform for security monitoring which has identified a significant vulnerability in its cluster synchronization protocol. This weakness allows authenticated nodes to write arbitrary files to the system file structure with the permissions granted to the 'wazuh' user. Because of insufficient default permissions, there is a risk of tampering with the main configuration file ('/var/ossec/etc/ossec.conf'). An attacker possessing cluster credentials could exploit this flaw to overwrite the configuration, injecting malicious command blocks that the 'wazuh-logcollector' service, which operates with root privileges, would subsequently execute. This exploit creates a pathway for full remote code execution, compromising system integrity and security protocols. The issue has been rectified in version 4.14.3.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References