Understanding and Defending Against CVE-2026-61800: Remote Code Execution in Wazuh
CVE-2026-61800 is a critical vulnerability in Wazuh, an open-source security platform, that allows a party holding the cluster key to write, overwrite, or delete arbitrary files under /var/ossec on worker nodes, leading to remote code execution as root. This vulnerability affects Wazuh versions 4.4.0 through 4.14.6 and is fixed in version 4.14.7. The vulnerability has a CVSS score of 9.1, indicating a high severity. Understanding the root cause, attack surface, and exploitation mechanics is crucial for defenders to implement effective mitigations and detections.