Is CVE-2026-44901 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44901 being exploited in the wild.

How severe is CVE-2026-44901?

High severity, with a CVSS score of 8.4, published 19 August 2026.

Which products and versions are affected?

Wazuh 4.0.0 to 4.14.5, 5.0.0-beta1.

Is there a fix for CVE-2026-44901?

A patch was published on 2026-04-28: Fix committed; versions 4.14.6 and 5.0.0-beta2 include patch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-44901 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-44901?

Check whether you run Wazuh at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44901: Wazuh remote code execution in cluster merge

CVE-2026-44901 · Severity: high · CVSS 8.4 · Published 2026-08-19

Wazuh is an open-source security platform used to detect and respond to threats across enterprise infrastructure. A vulnerability in how Wazuh's distributed cluster merges API responses allows a compromised worker node to execute arbitrary code on the master server with root privileges. An attacker controlling a worker node can inject malicious Python code that runs on the central management server when it processes results from multiple nodes.

Technologies: Wazuh. Vendors: Wazuh.

Quick answers

Is CVE-2026-44901 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44901 being exploited in the wild.
How severe is CVE-2026-44901?: High severity, with a CVSS score of 8.4, published 19 August 2026.
Which products and versions are affected?: Wazuh 4.0.0 to 4.14.5, 5.0.0-beta1.
Is there a fix for CVE-2026-44901?: A patch was published on 2026-04-28: Fix committed; versions 4.14.6 and 5.0.0-beta2 include patch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44901 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-44901?: Check whether you run Wazuh at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in AffectedItemsWazuhResult.merge() within framework/wazuh/core/results.py, which unsafely resolves attacker-controlled type names from the sort_casting field in cluster worker JSON responses through Python builtins without an allowlist. An attacker with control of a worker node can set sort_casting to "exec" and place Python source code in the affected_items field; when the master merges responses from multiple nodes, the payload executes with root privileges. The fix adds type validation to restrict sort_casting to an allowlist of safe types ('int', 'float', 'str', 'bool') and enforces structural validation (must be a list of strings). Affected versions are 4.0.0 through 4.14.5 and 5.0.0-beta1, with patches released in 4.14.6 and 5.0.0-beta2.

Affected products

Wazuh Wazuh 4.0.0 to 4.14.5, 5.0.0-beta1

Timeline

2026-08-19: disclosed
2026-04-28: patched: Fix committed; versions 4.14.6 and 5.0.0-beta2 include patch

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.