# CVE-2025-24016: GO-2025-3459 - Remote code execution in Wazuh server in github.com/wazuh/wazuh

Source: https://junglewise.ai/threats/cve-2025-24016-wazuh-server-remote-code-execution-via-unsafe-deserialization  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-03-03. Updated: 2026-05-15  
License: CC BY 4.0 with a link back

CVE-2025-24016 · Severity: critical · CVSS 3.1 · Exploited in the wild · Published 2025-03-03

Wazuh is a security platform used by organizations to monitor for threats and manage incident responses. A critical vulnerability has been identified that allows an attacker to take full control of the Wazuh server by executing malicious code. This could lead to a total compromise of the security monitoring infrastructure, allowing attackers to disable alerts or steal sensitive security data.

Technologies: [github.com/wazuh/wazuh (Go)](https://junglewise.ai/threats/technologies/github-com-wazuh-wazuh). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Wazuh](https://junglewise.ai/threats/vendors/wazuh).

## Quick answers

**Is CVE-2025-24016 exploited in the wild?** Yes. CVE-2025-24016 is known to be exploited in the wild, first recorded on 10 June 2025. Treat it as urgent.

**How severe is CVE-2025-24016?** Critical severity, with a CVSS score of 3.1, published 3 March 2025.

**Which products and versions are affected?** github.com/wazuh/wazuh (Go) SEMVER:introduced=4.4.0,fixed=4.9.1, SEMVER:introduced=4.4.0+incompatible,fixed=4.9.1+incompatible; Wazuh Server 4.4.0 to 4.9.0.

**Is there a fix for CVE-2025-24016?** Yes. github.com/wazuh/wazuh (Go): upgrade to 4.9.1, 4.9.1+incompatible or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-24016 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2025-24016?** Check whether you run github.com/wazuh/wazuh (Go) or Wazuh Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/wazuh/wazuh (Go): upgrade to 4.9.1, 4.9.1+incompatible or later

  ```sh
  go get github.com/wazuh/wazuh@v4.9.1+incompatible
  ```


## Technical details

An unsafe deserialization vulnerability exists in the Wazuh DistributedAPI (DAPI) due to the improper handling of JSON-serialized parameters. The root cause is located in the `as_wazuh_object` function within `framework/wazuh/core/cluster/common.py`. An attacker who can inject an unsanitized dictionary into a DAPI request or response can forge an unhandled exception (`__unhandled_exc__`) to evaluate arbitrary Python code. This can be triggered by any user with API access, including compromised dashboards, cluster servers, or in some cases, compromised agents. The vulnerability is addressed in version 4.9.1.

## Affected products

- Wazuh Wazuh Server 4.4.0 to 4.9.0

## Identifiers

- CVE-2025-24016
- GHSA-hcrc-79hj-m3qh
- GO-2025-3459

## Timeline

- 2025-02-10: disclosed: Initial CVE publication and GitHub advisory disclosure.
- 2025-02-10: patched: Fix released in version 4.9.1.
- 2025-06-10: kev added: CISA added the vulnerability to the Known Exploited Vulnerabilities (KEV) catalog.
- 2025-06-10: exploited: Vulnerability confirmed to be exploited in the wild.

## Related threats

- [GO-2025-3445 - Ability to view Agent list with no privilege access in wazuh-dashboard in github.com/wazuh/wazuh](https://junglewise.ai/threats/cve-2024-47770-go-2025-3445-ability-to-view-agent-list-with-no-privilege-access)
- [GO-2025-3444 - Improper Access Control in wazuh-agent in github.com/wazuh/wazuh](https://junglewise.ai/threats/cve-2024-35177-go-2025-3444-improper-access-control-in-wazuh-agent-in-github-com)