CVE-2026-54085: 
Wazuh Server vulnerability analysis and mitigation

CVE-2026-54085 is an argument injection vulnerability in Wazuh's active response framework, affecting versions 4.2.0 through 4.14.6 of both wazuh-agent and wazuh-manager. Multiple active response scripts pass attacker-influenced alert fields (srcip and dstuser) to privileged system commands without adequate input validation, enabling argument injection into tools running as root. The vulnerability was published on August 28, 2026, and fixed in version 4.14.7. It carries a CVSS v3.1 base score of 7.1 (High) per NVD, though the GitHub advisory rates it Moderate (5.9) with higher attack complexity (GitHub Advisory).

The root cause is CWE-88 (Improper Neutralization of Argument Delimiters in a Command — Argument Injection). Five active response scripts — route-null.c, netsh.c, pf.c, npf.c, and ipfw.c — extract the srcip field from alert JSON and pass it directly to firewall/routing commands (pfctl, npfctl, ipfw, route, netsh) without calling get_ip_version(), which uses getaddrinfo() with AI_NUMERICHOST to reject non-IP strings. Separately, disable-account.c passes the dstuser field to passwd -l or chuser with only a string comparison against "root", allowing arbitrary usernames to be injected. On Windows, wpopenv() in src/shared/exec_op.c concatenates command-line arguments without quoting arguments beyond argv[0], so a srcip value containing spaces can inject additional arguments into CreateProcess. An attacker who can inject crafted log events — for example via syslog over UDP/514 — can trigger these code paths when an active response rule fires (GitHub Advisory, Fix Commit).

Successful exploitation allows an attacker to inject additional arguments into privileged firewall and account-management commands running as root, potentially manipulating firewall rules (via pfctl, npfctl, ipfw, route, netsh) or locking arbitrary system accounts via disable-account.c (a denial-of-service impact). On Windows, the unquoted CreateProcess concatenation broadens the argument injection surface. There is no direct confidentiality impact, but integrity is highly affected through unauthorized modification of firewall state, and availability is impacted through account lockouts (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the time of this report. The EPSS score is approximately 0.235%, indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires low privileges (the ability to inject crafted log events, e.g., via syslog) and is not automatable according to NVD SSVC assessment (GitHub Advisory).

1. Reconnaissance: Identify Wazuh deployments running versions 4.2.0–4.14.6 with active response rules enabled that use affected scripts (route-null, netsh, pf, npf, ipfw, or disable-account).
2. Gain log injection capability: Obtain access to a syslog source that Wazuh monitors (e.g., a compromised host sending syslog to UDP/514, or a misconfigured log forwarder).
3. Craft malicious log event: Construct a log event that Wazuh's analysisd will parse and that triggers an active response rule. Embed a malicious srcip value (e.g., --option malicious_arg or a space-separated string on Windows) or a crafted dstuser value (e.g., a username with special characters targeting disable-account).
4. Trigger active response: Send the crafted log event so Wazuh processes it, extracts the unvalidated srcip or dstuser field, and dispatches it to the affected active response script via execd.
5. Achieve argument injection: The unvalidated field is passed to a privileged command (e.g., pfctl -t wazuh_fwtable -T add <injected_args> or passwd -l <crafted_user>), injecting attacker-controlled arguments into the root-level command, manipulating firewall rules or locking system accounts (GitHub Advisory).

• Network: Unexpected or malformed syslog messages (UDP/514) arriving at the Wazuh manager containing non-IP strings in fields that would map to srcip, or unusual usernames in dstuser fields.
• Logs: Wazuh active response debug logs (/var/ossec/logs/active-responses.log) showing errors such as "Cannot read 'srcip' from data or invalid IP format" or unexpected command invocations; analysisd logs showing alerts with anomalous srcip or dstuser values.
• Process: Unexpected child processes of Wazuh's execd daemon invoking pfctl, npfctl, ipfw, route, netsh, or passwd with unusual or non-IP arguments.
• File System: Changes to firewall rule tables (e.g., wazuh_fwtable or wazuh_blacklist) containing non-IP entries; system account lockouts not correlated with legitimate administrative activity (GitHub Advisory).

Wazuh has released version 4.14.7, which centralizes input validation by moving get_ip_version() calls into get_srcip_from_json() and adding a new is_valid_username() function called from get_username_from_json(), ensuring all active response scripts benefit from validation automatically. Organizations should upgrade both wazuh-agent and wazuh-manager to version 4.14.7 as the primary remediation. As a temporary workaround prior to patching, administrators can disable active response rules that invoke the affected scripts (route-null, netsh, pf, npf, ipfw, disable-account) or restrict syslog input sources to trusted hosts only (GitHub Advisory, Fix Commit).

The vulnerability was reported by researcher TristanInSec and remediated by Wazuh developer vikman90. The GitHub security advisory was published on August 18, 2026, with the fix committed shortly after. No significant broader media coverage or notable community commentary beyond the official advisory has been identified at this time (GitHub Advisory).