Wazuh is a free and open source platform used for threat prevention, detection, and response.
CVE-2025-24016 Exploited
Summary An unsafe deserialization vulnerability allows for remote code execution on Wazuh servers. The vulnerability can be triggered by anybody with API access (compromised dashboard or Wazuh servers in the cluster) or, in certain configurations, even by a compromised agent. Details DistributedAPI parameters are a serialized as JSON and deserialized using aswazuhobject (in framework/wazuh/core/cluster/common.py). If an attacker manages to inject an unsanitized dictionary in DAPI request/response, they can forge an unhandled exception (unhandledexc) to evaluate arbitrary python code. Using the server API, it quite easy to trigger. For example, using the runas endpoint (implemented by runaslogin in api/api/controllers/securitycontroller.py): the authcontext argument is completely controlled by the attacker, and is forwarded to the master server to handle. By sending a malicious runas request to a worker server, it is possible to execute code on the master server. It is also possible to exploit the bug as a compromised agent, in certain configurations. A compromised agent can respond to a getconfig request with a malicious JSON object (containing a serialized unhandled exception).…
Being exploited in the wild
Catalogued 10 June 2025 · US federal remediation deadline 1 July 2025
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Exploit code is also public: Metasploit · Public PoC · Nuclei template
- Metasploitexploit/linux/http/wazuh_auth_rce_cve_2025_24016
- NucleiWazuh - Unsafe Deserialization Remote Code Execution
- Public PoC0xjessie21/CVE-2025-2401643 stars
- Public PoCguinea-offensive-security/Wazuh-RCE8 stars
- Public PoCMuhammadWaseem29/CVE-2025-240166 stars
- Public PoChuseyinstif/CVE-2025-24016-Nuclei-Template4 stars
- Public PoCcybersecplayground/CVE-2025-24016-Wazuh-Remote-Code-Execution-RCE-PoC2 stars
- Public PoCrxerium/CVE-2025-240162 stars
- Public PoCGloStarRx1/CVE-2025-240161 stars
- Public PoCcelsius026/poc_CVE-2025-24016
Assessment
- CVSS
- 9.9 (v3.1)
- Severity
- Critical
- EPSS
- 93.84% chance of exploitation in the next 30 days
- Known exploited
- Yes — listed in the CISA KEV catalog
- Exploit availability
- CISA KEV, Metasploit, Public PoC, Nuclei template
- Published
- 10 February 2025
- Last updated
- 17 June 2026
- Affected
- Wazuh · wazuh · Wazuh Server · wazuh · github.com/wazuh/wazuh
- Weakness
- CWE-502
- Assigner
- security-advisories@github.com
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H
At the source
References
- https://github.com/wazuh/wazuh/security/advisories/GHSA-hcrc-79hj-m3qh
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24016
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- https://nvd.nist.gov/vuln/detail/CVE-2025-24016
- https://github.com/advisories/GHSA-hcrc-79hj-m3qh
Community proofs of concept
No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.
Submit a proof of concept
Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2025-24016