Secuno
ENNL
Book demo

CVE-2026-44901

8.4 HIGHPublic exploitEPSS 0.65%
  1. Published19 Aug 2026

Description

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, AffectedItemsWazuhResult.merge() in framework/wazuh/core/results.py trusts the sort_casting field in a cluster worker's JSON response. During a distributed API merge, attacker-controlled type names are resolved through Python builtins without an allowlist. A compromised worker can set sort_casting to exec and place Python source in affected_items, causing the master to execute the payload as root when responses from multiple nodes are merged. This issue is fixed in versions 4.14.6 and 5.0.0-beta2.

CVSS 3.1 breakdown

Attack vectorAdjacent
Attack complexityLow
Privileges requiredHigh
User interactionNone
ScopeChanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Affected products

Wazuh Wazuh≥ 4.0.0 < 4.14.6 · 5.0.0

Remediation

Fixed in
Wazuh Wazuh≥ 4.14.6

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-919399.8
Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unserialize() without…
CVE-2026-117298.5
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through…
CVE-2023-543989.8
Yonyou U8 Cloud contains an unauthenticated Java deserialization vulnerability in the…
CVE-2026-132938.8
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through…
CVE-2026-617018.8
Laravel MagicLink creates links for authentication without a password or for accessing…
CVE-2026-909199.8
LightLLM through 1.2.0 contains a remote code execution vulnerability in the Config…

Frequently asked

Is CVE-2026-44901 being actively exploited?

CVE-2026-44901 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 0.65%.

How severe is CVE-2026-44901?

CVE-2026-44901 has a CVSS 3.1 base score of 8.4, rated high. EPSS estimates a 0.65% probability of exploitation.

Which products are affected by CVE-2026-44901?

Affected products include Wazuh Wazuh.

How do I fix CVE-2026-44901?

Upgrade affected software to a fixed version, for example Wazuh Wazuh 4.14.6 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-44901 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.