Is CVE-2026-61800 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-61800 being exploited in the wild.

How severe is CVE-2026-61800?

Critical severity, with a CVSS score of 9.1, published 28 August 2026.

Is there a fix for CVE-2026-61800?

A patch was published on 2026-06-24: Fix committed to repository (f7f7c4d) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-61800 attacked?

It is attacked over the network.

Am I affected by CVE-2026-61800?

Check whether you run Wazuh at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-61800: Wazuh arbitrary file write in cluster worker file sync

CVE-2026-61800 · Severity: critical · CVSS 9.1 · Published 2026-08-28

Wazuh is an open-source security monitoring platform used to protect endpoints and cloud infrastructure. A compromised cluster master or anyone with the cluster key can write or delete arbitrary files under /var/ossec on all worker nodes, including files executed as root, resulting in remote code execution across the entire worker fleet.

Technologies: Wazuh. Vendors: Wazuh.

Quick answers

Is CVE-2026-61800 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-61800 being exploited in the wild.
How severe is CVE-2026-61800?: Critical severity, with a CVSS score of 9.1, published 28 August 2026.
Which products and versions are affected?: Wazuh 4.4.0 through 4.14.6.
Is there a fix for CVE-2026-61800?: A patch was published on 2026-06-24: Fix committed to repository (f7f7c4d) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61800 attacked?: It is attacked over the network.
Am I affected by CVE-2026-61800?: Check whether you run Wazuh at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a path traversal vulnerability in the cluster worker file synchronization code (framework/wazuh/core/cluster/worker.py, update_master_files_in_worker function). The non-merged and extra file branches lack a destination-directory confinement check that exists on the master side and in the worker's merged branch. While safe_join() prevents escape outside /var/ossec, it does not validate that files land in their declared cluster_item_key directory, allowing an attacker to place files anywhere under /var/ossec including executable locations like active-response/bin, wodles, and integrations. The vulnerability affects versions 4.4.0 through 4.14.6 and is an incomplete fix for CVE-2026-30893. The cluster key is a shared secret distributed to all nodes, so any holder can exploit this. Fixed in version 4.14.7.

Affected products

Wazuh Wazuh 4.4.0 through 4.14.6

Timeline

2026-08-28: disclosed: CVE-2026-61800 published on NVD
2026-06-24: patched: Fix committed to repository (f7f7c4d)
2026-06-18: other: Fix authored
2026-08-18: other: GitHub Security Advisory GHSA-3jff-488g-335f published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.