---
id: 9174
title: "CVE-2026-25769: RCE via insecure deserialization in wazuh cluster - remote command execution through cluster protocol"
cve: CVE-2026-25769
source_domain: yokai.hakaisecurity.io
source_url: "https://yokai.hakaisecurity.io/cve-2026-25769-rce-via-insecure-deserialization-in-wazuh-cluster-remote-command-execution-through-cluster-protocol/"
published_at: "2026-03-17T16:51:53Z"
tags: ["rce", "vulnerability-research", "deserialization", "research"]
phying_url: "https://phying.com/item/9174"
lang: en
---

# CVE-2026-25769: RCE via insecure deserialization in wazuh cluster - remote command execution through cluster protocol

## Summary

Abstract In this research, Hakai Security Research Team has identified a critical Remote Code Execution (RCE) vulnerability in Wazuh versions up to 4.14.1 that allows arbitrary command execution on the master node through insecure deserialization in the cluster communication protocol. The vulnerability stems from the lack of validation in the as_wazuh_object() function, which automatically imports […]

## Intelligence Metadata

- **Sources:** yokai.hakaisecurity.io
- **CVE:** CVE-2026-25769
- **Published:** 2026-03-17T16:51:53Z
- **Original:** https://yokai.hakaisecurity.io/cve-2026-25769-rce-via-insecure-deserialization-in-wazuh-cluster-remote-command-execution-through-cluster-protocol/
- **Phying News:** https://phying.com/item/9174