CVE-2026-54085

Wazuh versions 4.2.0 through 4.14.6 contain an argument injection flaw (CWE-88) in multiple active response scripts that pass attacker-influenced alert fields to privileged system commands without validating their format. An attacker who can inject crafted log events, for example via syslog, can supply malicious srcip or dstuser values that, when an active response rule fires, are passed unvalidated to root-run tools such as pfctl, npfctl, ipfw, route, netsh, and passwd. This allows the attacker to inject additional command arguments; on Windows, the unquoted CreateProcess command-line concatenation in wpopenv() lets a srcip containing spaces append further arguments, and the disable-account.c script can be abused to lock arbitrary system accounts. Any Wazuh deployment running an affected version where attackers can influence ingested log data and where the affected active response scripts are configured is exposed, with impact concentrated on integrity (high) and availability (low) per the CVSS 7.1 score. No public proof-of-concept or known in-the-wild exploitation exists, and EPSS estimates only a 0.2% probability of exploitation within 30 days.

What to do: Upgrade to Wazuh 4.14.7, which contains the fix. Organizations that cannot upgrade promptly should restrict log sources that can deliver attacker-controlled srcip/dstuser values (especially internet-exposed syslog) and review or temporarily disable active response configurations that invoke the route-null, netsh, pf, npf, ipfw, or disable-account scripts, checking for untrusted events that could trigger injected command arguments or account lockouts.