CVE-2025-15616: 
Wazuh Server vulnerability analysis and mitigation

CVE-2025-15616 is a set of shell injection and untrusted search path vulnerabilities in Wazuh's wazuh-agent and wazuh-manager components, affecting versions 2.1.0 through 4.7.x (before 4.8.0). The flaws allow authenticated administrators to execute arbitrary OS commands by injecting malicious payloads through logcollector configuration, the maild SMTP server tag, and Kaspersky AR script --custom_flags parameters. The vulnerability was published on March 27, 2026, with the underlying advisory originally disclosed by Wazuh on January 13, 2025. It carries a CVSS v3.1 base score of 7.2 (High) and a CVSS v4.0 base score of 7.1 (High) (GitHub Advisory, Red Hat CVE).

The root cause is classified as CWE-94 (Improper Control of Generation of Code / Code Injection), with an additional untrusted search path component. Three distinct attack surfaces are identified: (1) wazuh-logcollector executes commands directly as read from configuration files without sufficient sanitization; (2) wazuh-maild in local server mode executes the command specified in the smtp_server configuration tag, and invokes system binaries (e.g., net.exe on Windows) without specifying their full path, enabling path hijacking by placing a malicious executable in the ossec-agent folder; (3) the Kaspersky AR script passes user-controlled --custom_flags values to extra_args without sanitization, enabling direct code injection. Exploitation requires network-accessible administrative privileges and no user interaction, and is triggered upon Wazuh service restart (GitHub Advisory).

Successful exploitation grants an attacker full remote code execution on affected Wazuh agent and manager hosts, with high impact to confidentiality, integrity, and availability. An attacker with administrative access can execute arbitrary OS commands, potentially compromising the entire monitored environment since Wazuh agents are typically deployed across many systems. This could enable lateral movement, credential theft, log tampering, or complete takeover of the security monitoring infrastructure (GitHub Advisory, Red Hat CVE).

1. Reconnaissance: Identify Wazuh manager or agent installations running versions 2.1.0 through 4.7.x with administrative API or configuration file access.
2. SMTP Server Injection (wazuh-maild): Modify the ossec.conf configuration file to set the smtp_server tag to a malicious shell command (e.g., smtp_server = $(malicious_command)). Upon Wazuh service restart, the command is executed by wazuh-maild.
3. Path Hijacking via net.exe (Windows agents): Place a malicious executable named net.exe inside the Wazuh ossec-agent installation folder. When Wazuh invokes the net command without a full path, Windows resolves it to the malicious binary in the current application directory first, executing the attacker's payload.
4. Kaspersky AR Script Injection: Configure the Kaspersky AR integration to pass attacker-controlled values via the --custom_flags parameter in extra_args. Upon service restart, the injected code is executed as part of the script invocation.
5. Achieve Persistence/Lateral Movement: Use the resulting shell access to establish persistence, exfiltrate credentials, or pivot to other systems monitored by the compromised Wazuh infrastructure (GitHub Advisory).

• File System: Presence of an unexpected net.exe or similarly named executable in the Wazuh ossec-agent installation directory on Windows hosts; unexpected files created in /tmp or other writable directories following Wazuh service restarts.
• Logs: Wazuh service logs showing unusual command execution originating from wazuh-maild or the Kaspersky AR script; configuration file (ossec.conf) modification timestamps inconsistent with authorized change windows.
• Process: Unexpected child processes spawned by wazuh-maild, wazuh-logcollector, or Kaspersky AR script processes (e.g., shells, network tools, or reverse shell utilities).
• Network: Outbound connections from Wazuh agent/manager hosts to unknown external IPs following service restarts, particularly from processes not normally initiating outbound traffic (GitHub Advisory).

Upgrade wazuh-agent and wazuh-manager to version 4.8.0 or later, which contains fixes for all identified shell injection and path hijacking issues. As interim mitigations, restrict administrative access to Wazuh configuration files and the Wazuh API, and validate/sanitize all configuration inputs — particularly smtp_server tags, logcollector command entries, and Kaspersky AR extra_args parameters. Apply the principle of least privilege to accounts with configuration modification capabilities, and monitor the ossec-agent directory on Windows hosts for unexpected executables (GitHub Advisory).

The vulnerability was internally discovered and disclosed by Wazuh researcher vikman90 as part of an internal security review (issue #15052), and the advisory was published on the Wazuh GitHub repository. No significant external researcher commentary or broad media coverage has been identified beyond standard vulnerability database aggregation (GitHub Advisory).