Wazuh Agent および Manager の OS コマンドインジェクションと信頼できない検索パス

Successful exploitation of CVE-2025-15616 could grant an attacker complete control over the Wazuh Agent or Manager host. This includes the ability to execute arbitrary commands, steal sensitive data (such as log files and configuration information), install malware, and potentially pivot to other systems within the network. The attack surface is broad, encompassing multiple configuration points, increasing the likelihood of exploitation. The potential for lateral movement is significant, as a compromised Wazuh agent could be used to gain access to other systems monitored by the Wazuh Manager. The blast radius extends to any data processed or monitored by Wazuh, making this a critical vulnerability for organizations relying on Wazuh for security monitoring.

Organizations heavily reliant on Wazuh for security information and event management (SIEM) are particularly at risk. Environments with custom Wazuh configurations, including those utilizing Kaspersky AR scripts, face a heightened risk due to the increased attack surface. Shared hosting environments where Wazuh agents are deployed on multi-tenant systems are also vulnerable.

• linux / server:

journalctl -u wazuh-agent -g 'command injection'
journalctl -u wazuh-manager -g 'command injection'

• linux / server:

ps aux | grep -i 'wazuh-agent' | grep -i 'command injection'
ps aux | grep -i 'wazuh-manager' | grep -i 'command injection'

• linux / server:

find /etc/wazuh/ -name '*.conf' -print0 | xargs -0 grep -i 'command injection'

1. 2026-03-27Disclosure

   disclosure

1. 予約済み2026-03-27
2. 公開日2026-03-27
3. EPSS 更新日2026-04-04

The primary mitigation for CVE-2025-15616 is to upgrade Wazuh Agent and Manager to version 4.8.0 or later, which contains the necessary fixes. If immediate upgrading is not possible, consider temporarily restricting access to configuration files and SMTP server settings. Review and validate all custom Kaspersky AR scripts for malicious code. Implement strict input validation and sanitization for any user-supplied data used in Wazuh configurations. Consider using a Web Application Firewall (WAF) to filter potentially malicious requests targeting Wazuh components, although this is not a complete solution. Monitor Wazuh logs for suspicious activity, particularly commands executed by the logcollector or maild processes.