Skip to main content
cvebuzz

CVE mentions, exploit signals, and PoC evidence in one fast public view.

CVE detail

CVE-2025-24016

Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.4.0 and prior to version 4.9.1, an unsafe deserialization vulnerability allows for remote code execution on Wazuh servers. DistributedAPI parameters are a serialized as JSON and deserialized using `as_wazuh_object` (in `framework/wazuh/core/cluster/common.py`). If an attacker manages to inject an unsanitized dictionary in DAPI request/response, they can forge an unhandled exception (`__unhandled_exc__`) to evaluate arbitrary python code. The vulnerability can be triggered by anybody with API access (compromised dashboard or Wazuh servers in the cluster) or, in certain configurations, even by a compromised agent. Version 4.9.1 contains a fix.

CVSS 9.9 · CriticalBuzz score 66.5KEV listed

Buzz score

Why this CVE is surfacing

Buzz score total 66.5

This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.

Buzz score components · mention 22.0 · diversity 19.5 · KEV 25.0 · OTX 0.0 · PoC 0.0
Mention score
22.0
8 evidence mentions in the snapshot
Diversity score
19.5
6 sources across 3 categories
KEV score
25.0
Known exploited vulnerability present
OTX score
0.0
0 OTX pulses
PoC score
0.0
0 repos · best confidence N/A
Best PoC traction
0
Maximum stars on a matched PoC repo

Why it matters now

Mention timeline

Total mentions
0
within the 30d window
Peak daily
0
highest bucket

Evidence

Source links by recency

Newest mentions first
8 source links · newest first
  • Week in review: Microsoft fixes exploited zero-day, Mirai botnets target unpatched Wazuh serversHelp Net Security

    Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Microsoft fixes zero-day exploited for cyber espionage (CVE-2025-33053) For June 2025 Patch Tuesday, Microsoft has fixed 66 new CVEs, including a zero-day exploited in the wild (CVE-2025-33053). Unpatched Wazuh servers targeted by Mirai botnets (CVE-2025-24016) Two Mirai botnets are exploiting a critical remote code execution vulnerability (CVE-2025-24016) in the open-source Wazuh XDR/SIEM platform, Akamai researchers have warned. Want fewer security … More →

    newswww.helpnetsecurity.comJun 15, 2025, 8:00 AM
  • U.S. CISA adds Wazuh, and WebDAV flaws to its Known Exploited Vulnerabilities catalogSecurity Affairs

    U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Wazuh, and WebDAV flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added ASUS RT-AX55 devices, Craft CMS, and ConnectWise ScreenConnect flaws to its Known Exploited Vulnerabilities (KEV) catalog. Below are the descriptions for these flaws: This week, Akamai researchers warned that […]

    newssecurityaffairs.comJun 12, 2025, 9:17 AM
  • Mirai botnet weaponizes PoC to exploit Wazuh open-source XDR flawCSO Online

    Researchers warn that several botnets built on the Mirai malware codebase are targeting outdated Wazuh XDR and SIEM management servers. For the past several months, the botnets have been exploiting a critical remote code execution vulnerability in Wazuh that was patched in February. Researchers from content delivery and security company Akamai first detected exploitation of […]

    newswww.csoonline.comJun 10, 2025, 10:15 PM
  • Mirai botnets exploit Wazuh RCE, Akamai warnedSecurity Affairs

    Mirai botnets are exploiting CVE-2025-24016, a critical remote code execution flaw in Wazuh servers, Akamai warned. Akamai researchers warn that multiple Mirai botnets exploit the critical remote code execution vulnerability CVE-2025-24016 (CVSS score of 9.9) affecting Wazuh servers. Wazuh is an open-source security platform used for threat detection, intrusion detection, log data analysis, and compliance […]

    newssecurityaffairs.comJun 10, 2025, 10:27 AM
  • Unpatched Wazuh servers targeted by Mirai botnets (CVE-2025-24016)Help Net Security

    Two Mirai botnets are exploiting a critical remote code execution vulnerability (CVE-2025-24016) in the open-source Wazuh XDR/SIEM platform, Akamai researchers have warned. What is Wazuh? Wazuh is a popular open-source security information and event management (SIEM) and extended detection and response (XDR) solution that’s widely used for host-based intrusion detection, log analysis, file integrity monitoring, and more. It’s core components are: Wazuh Manager (server component), which analyzes data and triggers alerts. Made to be installed … More →

    newswww.helpnetsecurity.comJun 10, 2025, 10:23 AM
  • Mirai Botnets Exploiting Wazuh Security Platform VulnerabilitySecurityWeek

    CVE-2025-24016, a critical remote code execution vulnerability affecting Wazuh servers, has been exploited by Mirai botnets.

    newswww.securityweek.comJun 9, 2025, 2:20 PM
  • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24016www.cisa.gov

    No excerpt available.

    Mitigationwww.cisa.govFeb 10, 2025, 8:15 PM
  • https://github.com/wazuh/wazuh/security/advisories/GHSA-hcrc-79hj-m3qhgithub.com

    No excerpt available.

    Exploitgithub.comFeb 10, 2025, 8:15 PM

Exploit code

Public exploit repository references

Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.

0 repository references · best confidence N/A · max 0 stars
No public PoC repositories have been matched yet.

Related records

Similar CVEs

6 related CVEs with shared weakness or product evidence
  • CVE-2026-28220

    Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to version 4.14.5, issues in the Cluster Distributed API (DAPI) handling allow…

    CVSS 8.4 · High
    1 mention
  • CVE-2026-25769

    Wazuh is a free and open source platform used for threat prevention, detection, and response. Versions 4.0.0 through 4.14.2 have a Remote Code Execution (RCE) vulnerability due to…

    CVSS 9.1 · Critical
    3 mentions
  • CVE-2026-67579

    Deserialization of Untrusted Data vulnerability in ash-project ash allows an unauthenticated attacker to inject a filter expression through a forged keyset pagination cursor, resu…

    CVSS 7.5 · High
    4 mentions
  • CVE-2026-73325

    Fujitsu Research's OneCompression library 1.2.0 contains an unsafe deserialization vulnerability that allows attackers to execute arbitrary code by supplying a crafted model.pt ch…

    CVSS 8.4 · High
    3 mentions
  • CVE-2026-67587

    Apache Airflow's Task SDK rebuilt a `Callback` object from serialized data by re-running its constructor, which imports the module named by the stored callback path. Because `Sync…

    CVSS N/A · Unrated
    4 mentions
  • CVE-2026-67260

    Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new `awaiting_input` task state swept by the scheduler. That sweep deserializes the task instance's `nex…

    CVSS 7.3 · High
    3 mentions