Active Exploitation of Critical RCE Vulnerability in Wazuh
CVE-2025-24016 could allow a remote, authenticated attacker to execute arbitrary Python code on the Wazuh server
Summary
CVE-2025-24016 could allow a remote, authenticated attacker to execute arbitrary Python code on the Wazuh server
Affected platforms
The following platforms are known to be affected:
Threat details
Active exploitation of CVE-2025-24016
Security researchers at Akamai have reported that CVE-2025-24016 is under active exploitation to deploy variants of the Mirai botnet. Additionally, multiple proof-of-concept exploits are publicly available.
The NHS England National CSOC assesses further exploitation as highly likely.
Introduction
Wazuh released a security advisory in February 2025 to disclose a critical vulnerability CVE-2025-24016 in the wazuh-manager component of Wazuh. Wazuh is an open-source XDR and SIEM platform. Security researchers have now reported that CVE-2025-24016 is under exploitation in multiple campaigns.
CVE-2025-24016 is "deserialization of untrusted data" vulnerability with a CVSSv3 score of 9.9. If exploited, a remote authenticated attacker with access to the Wazuh API or a compromised Wazuh agent could execute arbitrary Python code on the Wazuh server.
Remediation advice
Affected organisations are strongly encouraged to review GHSA-hcrc-79hj-m3qh and update Wazuh to version 4.9.1 or later.
Organisations are also encouraged to review Akamai's blog post detailing the exploitation campaign and hunt for malicious behaviour and indicators across their estate.
Indicators of compromise
Definitive source of threat updates
Last edited: 13 June 2025 12:23 pm