CVE-2025-24016

The vulnerability in Wazuh, a widely used open-source platform for threat prevention, detection, and response, stems from an unsafe deserialization process that allows for remote code execution. This issue arises in versions 4.4.0 through 4.9.1, where the DistributedAPI parameters are serialized as JSON and subsequently deserialized using the `as_wazuh_object` function. The core of the problem lies in the potential for an attacker to inject an unsanitized dictionary into the DAPI request or response. By doing so, they can trigger an unhandled exception, which can be exploited to execute arbitrary Python code on the Wazuh server. This vulnerability is particularly severe due to its ability to be exploited by any user with API access, including those who may have compromised dashboards or servers within the Wazuh cluster.

The attack vectors associated with this vulnerability are diverse and can be executed through various means. An attacker could leverage compromised API credentials to send malicious requests directly to the Wazuh server, thereby injecting harmful payloads into the deserialization process. Additionally, in certain configurations, even a compromised agent within the Wazuh environment could initiate an attack. This broad attack surface significantly increases the risk, as it allows for exploitation by both external adversaries and internal threats. The ability to execute arbitrary code remotely could lead to a complete takeover of the Wazuh server, enabling attackers to manipulate security configurations, exfiltrate sensitive data, or pivot to other systems within the network.

The real-world impact of this vulnerability is profound, particularly for organizations relying on Wazuh for their security monitoring and incident response. A successful exploitation could lead to unauthorized access to critical security data, disruption of security operations, and potential compliance violations, especially for organizations subject to data protection regulations. The business risks associated with such an incident include reputational damage, financial losses due to remediation efforts, and potential legal ramifications stemming from data breaches. Furthermore, the ability to execute arbitrary code could allow attackers to deploy additional malware or ransomware, exacerbating the situation and leading to further financial and operational consequences.

To detect and mitigate this vulnerability, organizations should prioritize upgrading to version 4.9.1 or later, where the issue has been addressed. Regularly updating software to the latest versions is a fundamental best practice in cybersecurity. Additionally, implementing robust access controls to limit API access to trusted users and systems can help reduce the attack surface. Monitoring API traffic for unusual patterns or unauthorized requests can also serve as an early warning system for potential exploitation attempts. Employing application security measures, such as input validation and sanitization, can further bolster defenses against deserialization attacks. Organizations should also conduct regular security assessments and penetration testing to identify and remediate vulnerabilities proactively.

In conclusion, the unsafe deserialization vulnerability in Wazuh presents a significant threat to organizations utilizing this platform for security management. The potential for remote code execution, coupled with the ease of exploitation, underscores the need for immediate attention and remediation. By adopting a proactive security posture that includes timely updates, stringent access controls, and continuous monitoring, organizations can mitigate the risks associated with this vulnerability and enhance their overall security posture.

CSURFACE threat intelligence has detected a marked escalation in exploitation attempts targeting the unsafe deserialization vulnerability in Wazuh servers. This increase in activity coincides with the recent addition of CVE-2025-24016 to the Known Exploited Vulnerabilities (KEV) catalog, signaling heightened attacker interest and potential prioritization in exploitation campaigns. Although the Exploit Prediction Scoring System (EPSS) score shows a slight decline, the surge in observed exploitation attempts and the proliferation of publicly available proof-of-concept exploits amplify the operational risk for organizations running vulnerable Wazuh versions. This evolving landscape underscores an elevated threat level, as adversaries are actively leveraging multiple publicly accessible tools to achieve remote code execution, increasing the likelihood of successful compromise. Defenders should recognize this shift as a critical escalation in the threat environment surrounding Wazuh deployments.

Update 2 — July 08, 2026

CSURFACE threat intelligence has detected a marked escalation in exploitation attempts targeting the CVE-2025-24016 vulnerability in Wazuh servers. This increase aligns with the continued proliferation of publicly available proof-of-concept exploits, which have grown in both number and community engagement. Our telemetry indicates that adversaries are increasingly leveraging these tools to conduct remote code execution attacks, suggesting a shift from experimental to more operational use. Although the EPSS score remains stable, the qualitative surge in detection activity signals heightened attacker interest and capability. This evolving threat landscape elevates the risk for organizations running vulnerable Wazuh versions, as the window for exploitation widens and the likelihood of successful compromise intensifies. Defenders should interpret this trend as a critical escalation in adversary activity, underscoring the urgency of addressing this vulnerability within their environments.