Remote Code Execution Vulnerability in Wazuh Security Platform
CVE-2026-61800

9.1CRITICAL

Key Information:

Vendor

Wazuh

Status
Wazuh
Vendor
CVE Published:
27 August 2026

What is CVE-2026-61800?

A vulnerability in the Wazuh Security Platform allows an attacker with access to the cluster key to write, overwrite, or delete files within the /var/ossec directory on worker nodes. This flaw arises from inadequate validation during file synchronization, permitting files to be directed to unauthorized locations and executed as root. This issue represents an incomplete mitigation of an earlier traversal vulnerability. Users are advised to update to version 4.14.7 to mitigate these risks.

Affected Version(s)

wazuh >= 4.4.0, < 4.14.7

References

https://github.com/wazuh/wazuh/security/advisories/GHSA-3...
x_refsource_CONFIRM
https://github.com/wazuh/wazuh/commit/f7f7c4d2d9e683c5d42...
x_refsource_MISC

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.