Cyber Posture

CVE-2026-30893

Critical

Published: 29 April 2026

Published
29 April 2026
Modified
30 April 2026
KEV Added
Patch
CVSS Score 9.0 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H
EPSS Score 0.0008 23.8th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-30893 is a critical-severity Path Traversal (CWE-22) vulnerability in Wazuh Wazuh. Its CVSS base score is 9.0 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation of Remote Services (T1210); ranked at the 23.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation of Remote Services (T1210) and 2 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly validates file path inputs in the cluster synchronization extraction routine to block path traversal attacks enabling arbitrary file writes.

prevent

Requires timely remediation of the path traversal flaw by patching Wazuh to version 4.14.4 or later, eliminating the vulnerability.

prevent

Enforces least privilege for the Wazuh cluster daemon to restrict damage from arbitrary file writes and potential code execution or system compromise.

MITRE ATT&CK Enterprise TechniquesAI

T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
T1059.006 Python Execution
Adversaries may abuse Python commands and scripts for execution.
T1570 Lateral Tool Transfer Lateral Movement
Adversaries may transfer tools or other files between systems in a compromised environment.
Why these techniques?

Path traversal in authenticated cluster sync enables remote arbitrary file write on peer nodes (T1570 lateral transfer), directly leading to RCE via Python module overwrite (T1059.006) by exploiting the remote Wazuh service (T1210).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.4.0 to before version 4.14.4, a path traversal vulnerability in Wazuh's cluster synchronization extraction routine allows an authenticated cluster peer to write arbitrary…

more

files outside the intended extraction directory on other cluster nodes. This can be escalated to code execution in the Wazuh service context by overwriting Python modules loaded by Wazuh components (proof of concept available as separate attachment). In deployments where the cluster daemon runs with elevated privileges, system-level compromise is possible. This issue has been patched in version 4.14.4.

Deeper analysisAI

CVE-2026-30893 is a path traversal vulnerability (CWE-22, CWE-73) in the cluster synchronization extraction routine of Wazuh, a free and open-source platform for threat prevention, detection, and response. It affects Wazuh versions from 4.4.0 up to but not including 4.14.4, enabling an authenticated cluster peer to write arbitrary files outside the intended extraction directory on other cluster nodes. The vulnerability carries a CVSS v3.1 base score of 9.0 (AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H), reflecting its critical potential impact despite requiring high privileges.

An attacker with authenticated access as a cluster peer can exploit this flaw remotely over the network with low complexity to perform arbitrary file writes on target nodes. This can be escalated to code execution within the Wazuh service context by overwriting Python modules loaded by Wazuh components, as demonstrated by a proof-of-concept. In configurations where the cluster daemon operates with elevated privileges, attackers could achieve full system-level compromise.

Wazuh has addressed the issue in version 4.14.4, as detailed in the release notes and GitHub Security Advisory GHSA-m8rw-v4f6-8787. Security practitioners should upgrade to 4.14.4 or later and review cluster configurations to ensure peers are trusted and daemons run with least privileges.

Details

CWE(s)

Affected Products

wazuh
wazuh
4.4.0 — 4.14.4

CVEs Like This One

CVE-2026-25769Same product: Wazuh Wazuh
CVE-2025-30201Same product: Wazuh Wazuh
CVE-2026-25770Same product: Wazuh Wazuh
CVE-2025-24016Same product: Wazuh Wazuh
CVE-2026-25772Same product: Wazuh Wazuh
CVE-2025-15615Same product: Wazuh Wazuh
CVE-2026-25790Same product: Wazuh Wazuh
CVE-2024-47770Same product: Wazuh Wazuh
CVE-2025-15612Same product: Wazuh Wazuh
CVE-2024-35177Same product: Wazuh Wazuh

References