CVE-2025-24016

Wazuh Server, the core component of the free and open-source Wazuh threat prevention, detection, and response platform, contains an unsafe deserialization flaw (CWE-502) affecting versions 4.4.0 through all releases prior to 4.9.1. DistributedAPI (DAPI) parameters are serialized as JSON and deserialized by the `as_wazuh_object` function in `framework/wazuh/core/cluster/common.py`; an attacker who injects an unsanitized dictionary into a DAPI request or response can forge an unhandled exception (`__unhandled_exc__`) to evaluate arbitrary Python code, yielding remote code execution on the server. The flaw is rated critical (CVSS 3.1: 9.9) and can be triggered by anyone with API access, such as a compromised dashboard or another Wazuh server in the cluster, and in certain configurations even by a compromised agent. All deployments of Wazuh Server running affected 4.4.x through 4.9.0 versions are affected, particularly those with the API or dashboard exposed to untrusted networks. Exploitation is confirmed in the wild: CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2025-06-10, and Akamai reported that two distinct Mirai botnets are actively targeting unpatched, internet-exposed Wazuh servers.

What to do: Upgrade Wazuh to version 4.9.1 or later immediately, as required for federal systems under CISA KEV/BOD 22-01 guidance. Until patched, restrict internet exposure of the Wazuh API, dashboard, and cluster communications, and assume compromised agents may be a trigger path in affected configurations. Hunt unpatched servers for signs of compromise, since Mirai botnets are actively scanning for and exploiting this flaw.