Get real-time updates on Telegram
CVE-2025-15616: wazuh from 2.1.0 (inclusive), before 4.8.0 (exclusive); +2 more affected products
CVE-2025-15616. CVSS 3.1 base score 7.2 (HIGH, NVD). EPSS 0.01625 (percentile 0.75533), scored 13-Oct-2026.
Affected technology
wazuh · from 2.1.0 (inclusive), before 4.8.0 (exclusive)
wazuh
wazuh-agent · 2.1.0 to before 4.8.0
Wazuh
wazuh-manager · 2.1.0 to before 4.8.0
Wazuh
Description’s affected range: versions 2.1.0 before 4.8.0
Component: Not specified by the source
Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · High privileges required · No user interaction required
What an attacker can do
Attackers can exploit these vulnerabilities by injecting malicious commands through configuration files, SMTP server settings, and custom flags to achieve remote code execution on affected systems. Vendor/CNA’s CVSS 4.0 assessment (base score 7.1/10) rates confidentiality impact as low; integrity and availability impact as high.
- CWE
- CWE-94
- CCR priority
- 29.2 /100 (P4)
- CVSS 3.1
- 7.2 /10 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · NVD
- EPSS
- 0.01625 · percentile 0.75533 · 2026-10-13
- KEV
- no
Provenance
- NVD CVE API 2.0 · Source record · observed 2026-10-15 01:07:31.726917+00:00 UTC
Stable permalink: https://cybercodered.org/item/cve-cve-2025-15616.html