CVE-2026-54085

Analyzed Analyzed - Analysis Complete

Command Injection in Wazuh Active Response Scripts

Publication date: 2026-08-28

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.2.0 through 4.14.6, multiple active response scripts pass attacker-influenced alert fields to privileged system commands without validating their format, allowing argument injection into tools that run as root. Five of the eight scripts that handle the srcip field, route-null.c, netsh.c, pf.c, npf.c, and ipfw.c, omit the get_ip_version() check that rejects non-IP input, and disable-account.c passes the dstuser field to passwd/chuser with only a comparison against "root". An attacker who can inject crafted log events, for example via syslog, can supply srcip or dstuser values that, when an active response rule triggers, are passed unvalidated to firewall and account-management commands such as pfctl, npfctl, ipfw, route, netsh, and passwd. This enables injecting additional command arguments, and on Windows the unquoted CreateProcess command-line concatenation in wpopenv() lets a srcip containing spaces add further arguments, while disable-account.c can be abused to lock arbitrary system accounts. This issue is fixed in version 4.14.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-09-15

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-54085

Affected Vendors & Products

Vendor	Product	Version / Range
wazuh	wazuh	From 4.2.0 (inc) to 4.14.7 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-88	The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

Attack-Flow Graph

Executive Summary

CVE-2026-54085 is an argument injection vulnerability in Wazuh versions 4.2.0 through 4.14.6. It occurs because multiple active response scripts pass attacker-controlled alert fields like srcip or dstuser to privileged system commands without proper validation. This allows attackers to inject additional command arguments, potentially executing unauthorized commands, manipulating firewall rules, or locking system accounts.

Detection Guidance

To detect this vulnerability, check if your Wazuh installation is running a vulnerable version (4.2.0 to 4.14.6). Review active response scripts for missing input validation in srcip or dstuser fields. Look for unexpected command execution logs or firewall rule changes. No specific commands are provided in the context.

Impact Analysis

If exploited, this vulnerability could allow attackers to execute arbitrary commands with root privileges, modify firewall rules to bypass security controls, or lock critical system accounts causing denial of service. Attackers need the ability to inject crafted log events, such as via syslog, to trigger the vulnerable scripts.

Compliance Impact

This vulnerability could lead to unauthorized access or system modifications, violating confidentiality and integrity requirements in GDPR and HIPAA. Compromised systems may fail compliance audits due to inadequate input validation controls and potential data breaches.

Mitigation Strategies

Upgrade Wazuh to version 4.14.7 or later to apply the security fixes. Review and update active response scripts to ensure proper input validation for srcip and dstuser fields. Remove or restrict unnecessary privileges for scripts handling these fields.

Hi! I’m here to help you understand CVE-2026-54085. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70