Is CVE-2026-54085 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54085 being exploited in the wild.

How severe is CVE-2026-54085?

High severity, with a CVSS score of 7.1, published 28 August 2026.

Which products and versions are affected?

Wazuh Agent 4.2.0 to 4.14.6; Wazuh Manager 4.2.0 to 4.14.6.

Is there a fix for CVE-2026-54085?

A patch was published on 2026-06-08: Fix committed; version 4.14.7 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54085 attacked?

It is attacked over the network.

Am I affected by CVE-2026-54085?

Check whether you run Wazuh, Wazuh Agent or Wazuh Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54085: Wazuh active response argument injection in firewall and account scripts

CVE-2026-54085 · Severity: high · CVSS 7.1 · Published 2026-08-28

Wazuh is an open-source security platform that monitors endpoints and cloud infrastructure for threats and automatically responds to detected attacks. Multiple built-in response scripts fail to validate user input before passing it to privileged system commands, allowing an attacker who can inject crafted log events to execute arbitrary commands as root. This could enable an attacker to modify firewall rules, lock system accounts, or execute other privileged operations, compromising the security of protected systems.

Technologies: Wazuh, Wazuh Agent, Wazuh Manager. Vendors: Wazuh.

Quick answers

Is CVE-2026-54085 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54085 being exploited in the wild.
How severe is CVE-2026-54085?: High severity, with a CVSS score of 7.1, published 28 August 2026.
Which products and versions are affected?: Wazuh Agent 4.2.0 to 4.14.6; Wazuh Manager 4.2.0 to 4.14.6.
Is there a fix for CVE-2026-54085?: A patch was published on 2026-06-08: Fix committed; version 4.14.7 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54085 attacked?: It is attacked over the network.
Am I affected by CVE-2026-54085?: Check whether you run Wazuh, Wazuh Agent or Wazuh Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is an argument injection flaw (CWE-88) in Wazuh's active response framework. Five firewall scripts (route-null.c, netsh.c, pf.c, npf.c, ipfw.c) omit IP validation before passing the srcip field to commands like pfctl, npfctl, ipfw, and route running as root. Similarly, disable-account.c passes the dstuser field to passwd/chuser with minimal validation. An attacker can inject crafted log events via syslog (UDP/514) containing malicious srcip or dstuser values; when an active response rule triggers, these unvalidated strings are concatenated into command lines. On Windows, unquoted CreateProcess argument concatenation in wpopenv() allows srcip values with spaces to inject additional arguments. The vulnerability requires log injection capability but no elevated privileges to trigger exploitation. Patches are available in version 4.14.7, which adds centralized input validation (get_ip_version() for IPs, is_valid_username() for usernames) applied uniformly across all active response scripts.

Affected products

Wazuh Wazuh Agent 4.2.0 to 4.14.6
Wazuh Wazuh Manager 4.2.0 to 4.14.6

Timeline

2026-08-28: disclosed
2026-06-08: patched: Fix committed; version 4.14.7 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.