The vulnerability allows shell injection and the use of an untrusted search path across multiple components of the Wazuh Agent and Manager; attackers can inject malicious shell commands into logcollector configuration files, maild SMTP server tags, and Kaspersky AR script parameters to execute arbitrary commands.

Affected products are Wazuh wazuh-agent and Wazuh wazuh-manager; all releases from version 2.1.0 up to, but not including, 4.8.0 are vulnerable.

The CVSS score of 7.1 indicates high severity, and the EPSS score of less than 1% suggests a low probability of widespread exploitation; the vulnerability is not listed in CISA's KEV catalog. The description shows that attackers can inject them through configuration files, SMTP server settings, or custom flags, meaning that write access to these configuration areas or the ability to alter them is required; it is inferred that such access is needed to exploit the vulnerability. Once injected, the malicious code would run with the privileges of the running service, potentially compromising the entire system.