CVE-2025-15616

Wazuh Agent and Manager OS Command Injection and Untrusted Search Path

State: Published
Severity: 7.1 High
Published: Mar 27, 2026
Updated: Jul 14, 2026
Reserved: Mar 27, 2026

Description

Wazuh wazuh-agent and wazuh-manager versions 2.1.0 before 4.8.0 contain multiple shell injection and untrusted search path vulnerabilities that allow attackers to execute arbitrary commands through various components including logcollector configuration, maild SMTP server tags, and Kaspersky AR script parameters. Attackers can exploit these vulnerabilities by injecting malicious commands through configuration files, SMTP server settings, and custom flags to achieve remote code execution on affected systems.

Scores

CVSS	Score	Vector	Source
4.0	7.1 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N	VulnCheck
3.1	6.7 Medium	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H	VulnCheck

Weaknesses

CWE-94 Improper Control of Generation of Code ('Code Injection')

Affected Products

Product	Versions
wazuh-agentWazuh	2.1.0 to before 4.8.0Affected
wazuh-managerWazuh	2.1.0 to before 4.8.0Affected

References

https://github.com/wazuh/wazuh/security/advisories/GHSA-522v-p59v-58gmvendor-advisory
https://www.vulncheck.com/advisories/multiple-vulnerabilities-related-to-shell-injection-and-path-traversal-flawsthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.