CVE-2026-48162

criticalpriority · track · 0EPSS 0.007 · 51 %ileUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.65% (51st) EPSS

CVSS 9.1 · critical

Is it mine?

2 products

Check your exposure

Who says so?

1 sources

nvd

EPSS · scored 2026-10-27

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta3, DistributedAPI.send_tmp_file() in framework/wazuh/core/cluster/dapi/dapi.py joins an attacker-controlled tmp_file value to WAZUH_PATH without canonicalization or confinement. A cluster peer holding the shared Fernet key can use traversal or an absolute path to make the master return any readable file over the cluster channel. Reading /var/ossec/api/configuration/security/private_key.pem allows the peer to forge administrator REST API tokens offline and then exercise administrative privileges without creating an account. This issue is fixed in versions 4.14.6 and 5.0.0-beta3.

cvss

Technical severity, 0–10. One row per scoring source.

9.1

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 8.3–9.1

v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:Hsecondary · security-advisories@github.comexploitability 2.3 · impact 6

v3.18.3highCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: poc · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-73US

affected products (2)

Products and version ranges known to be affected.

wazuh wazuh4.0.0 → 4.14.6nvdUScpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*
wazuh wazuh= 5.0.0nvdUScpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*

sources

Which sources assert this record, and when.

nvd NVD CVE.org MITRE

published 2026-08-19modified 2026-10-26

references (5) nvd

External citations — patches, advisories, analysis.

https://github.com/wazuh/wazuh/commit/de1eeedbe336744934be4e20d87d84a76e438ceePatch
https://github.com/wazuh/wazuh/pull/36246Issue TrackingPatch
https://github.com/wazuh/wazuh/releases/tag/v4.14.6PatchRelease Notes
https://github.com/wazuh/wazuh/releases/tag/v5.0.0-beta3PatchRelease Notes
https://github.com/wazuh/wazuh/security/advisories/GHSA-r6f5-h662-8ffcExploitVendor Advisory

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan