CVE-2026-54085: Wazuh Active Response RCE Vulnerability

CVE-2026-54085 Overview

CVE-2026-54085 is an argument injection vulnerability [CWE-88] in Wazuh, an open-source XDR and SIEM platform. Versions 4.2.0 through 4.14.6 pass attacker-influenced alert fields to privileged system commands without validating their format. Five active response scripts that handle the srcip field, route-null.c, netsh.c, pf.c, npf.c, and ipfw.c, omit the get_ip_version() check that rejects non-IP input. The disable-account.c script passes the dstuser field to passwd and chuser with only a comparison against "root". An attacker who can inject crafted log events, for example via syslog, can supply values that reach firewall and account-management commands running as root.

Critical Impact
An authenticated log source can inject arguments into pfctl, npfctl, ipfw, route, netsh, and passwd running as root, and lock arbitrary system accounts including on Windows agents via unquoted CreateProcess concatenation.

Affected Products

Wazuh 4.2.0 through 4.14.6
Wazuh active response scripts: route-null, netsh, pf, npf, ipfw, disable-account
Wazuh Windows agents using wpopenv() command construction

Discovery Timeline

2026-08-28 - CVE-2026-54085 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-54085

Vulnerability Analysis

Wazuh's active response framework executes scripts as root when alert rules trigger. The scripts receive JSON payloads containing alert fields including srcip (source IP) and dstuser (destination user). These fields flow directly into command arguments for firewall utilities and account-management tools.

Five scripts handling srcip skip the get_ip_version() validation that rejects non-IP strings. As a result, a srcip value can contain shell metacharacters, additional command flags, or space-separated tokens. When passed to pfctl, npfctl, ipfw, route, or netsh, these tokens are interpreted as extra arguments. The disable-account.c script performs only a literal comparison against "root" on the dstuser field, so any other user string including system accounts reaches passwd or chuser unchecked.

Root Cause

The root cause is missing centralized input validation in the active response framework [CWE-88]. Individual scripts trusted upstream sanitation that never occurred. On Windows agents, wpopenv() builds the CreateProcess command line by unquoted concatenation, so a srcip containing spaces splits into separate argv entries.

Attack Vector

An attacker who can inject log events, commonly via an exposed syslog listener or a compromised monitored host, crafts a message where the parsed srcip or dstuser field contains adversary-controlled arguments. When a Wazuh rule with an active response triggers on that alert, the manager dispatches the field to an agent, which executes the privileged command with the injected arguments.

// Patch: src/active-response/active_responses.c
// Centralized srcip validation added to get_srcip_from_json()
srcip_json = get_srcip_from_win_eventdata(data_json);
if (cJSON_IsString(srcip_json)) {
    const char *srcip = srcip_json->valuestring;

    // Validate IP format
    if (get_ip_version(srcip) == OS_INVALID) {
        return NULL;
    }

    return srcip;
}
// Detect srcip from data
srcip_json = cJSON_GetObjectItem(data_json, "srcip");
if (cJSON_IsString(srcip_json)) {
    const char *srcip = srcip_json->valuestring;

    if (get_ip_version(srcip) == OS_INVALID) {
        return NULL;
    }

    return srcip;
}

Source: GitHub Wazuh Commit b7f3a5e

Detection Methods for CVE-2026-54085

Indicators of Compromise

Alert events where the srcip field contains spaces, dashes, or shell metacharacters instead of a valid IPv4 or IPv6 address.
Alert events where dstuser references privileged local accounts other than the literal string root.
Unexpected invocations of pfctl, npfctl, ipfw, route, netsh, or passwd by the Wazuh agent with unusual arguments.
Locked system service accounts on hosts running Wazuh active response scripts.

Detection Strategies

Parse Wazuh active-responses.log for command lines where the IP argument fails a strict IPv4/IPv6 regex.
Correlate agent process telemetry against parent process ossec-execd or wazuh-execd invoking firewall or account tools with anomalous argument counts.
Flag syslog ingestion patterns where source IP fields contain non-numeric tokens or long strings.

Monitoring Recommendations

Monitor Wazuh manager logs for active response rule triggers sourced from externally reachable syslog collectors.
Audit account lockout events on Linux, AIX, and Windows hosts and correlate them with active response execution timestamps.
Alert on any modification to firewall tables or routing tables initiated by the Wazuh agent user.

How to Mitigate CVE-2026-54085

Immediate Actions Required

Upgrade Wazuh manager and agents to version 4.14.7 or later, which introduces centralized srcip validation in active_responses.c.
Restrict syslog and log-forwarding endpoints so only trusted sources can inject events that feed active response rules.
Review and temporarily disable active response scripts route-null, netsh, pf, npf, ipfw, and disable-account until patches are applied.

Patch Information

The fix is delivered in Wazuh 4.14.7. Commit b7f3a5e59000e4cdef75f397f1107ae3e1c186a9 adds a centralized get_ip_version() check inside get_srcip_from_json() so non-IP values return NULL before reaching privileged commands. See the GitHub Security Advisory GHSA-mvh4-g699-984j for full advisory details.

Workarounds

Disable the affected active response scripts in ossec.conf on manager and agents until upgrade is complete.
Configure Wazuh decoders and rules to drop or sanitize events where srcip fails a strict IP format check before an active response is fired.
Remove externally reachable syslog listeners, or place them behind an allowlisted relay that validates source-address fields.

bash

# Temporarily disable vulnerable active responses in /var/ossec/etc/ossec.conf
<active-response>
  <disabled>yes</disabled>
  <command>firewall-drop</command>
</active-response>
<active-response>
  <disabled>yes</disabled>
  <command>disable-account</command>
</active-response>

# Restart the Wazuh manager to apply
systemctl restart wazuh-manager