Wazuh 4.0.0 through 4.14.2 contain a Remote Code Execution vulnerability from deserialization of untrusted data, categorized as CWE-502. An attacker who gains any access to a worker node in a cluster deployment can inject malicious payloads during deserialization, leading to arbitrary code execution on the master node with root privileges. This compromise can allow full takeover of the entire cluster, impacting confidentiality, integrity, and availability.

The affected product is Wazuh, specifically versions 4.0.0 to 4.14.2 used in cluster mode. All deployments using the master/worker architecture are vulnerable, while version 4.14.3 and later contain the fix.

The CVSS score of 9.1 reflects high severity. The EPSS score of 9% indicates that exploitation is likely based on historical attack patterns. The vulnerability is not listed in CISA KEV, but the combination of high impact and relatively high exploitation probability makes this a critical risk for clusters exposed to the internet or with insufficient isolation. Once a worker node is compromised, the attacker can leverage insecure deserialization to produce full RCE on the master node, achieving root privileges and control over the entire environment.